All things related to multicast

["Taylor, Scott J." <>]

The first two sources are from my address space.  The first is an old Vbrick 
encoder unit and although I am not seeing it abnormally active in the 
224.2.127.254 group but it was configured to advertise to the SAP group.  
I've disabled SAP advertisements on it and can disable the stream completely 
if you still observe a problem from the unit.  The second is from one of our 
members and is likely a VLC client or VBrick unit.  I am seeing occasional 
joins to the SAP group but not a lot of traffic; I can try to reach the 
members if that unit is still a problem as well.

When I took a look earlier today I didn't see much traffic on the SAP group 
coming into our network and at this time I am not observing abnormal traffic 
either.

I am more than happy to look at things again if it still looks odd where you 
sit.

--
Scott J. Taylor | Network Engineer
Connecticut Education Network
University of Connecticut
V: +1.860.622.2242

http://cen.ct.gov

-----Original Message-----
From: Mark Foster 
[mailto:]
 
Sent: Friday, March 19, 2010 18:31
To: 

Cc: Leonard Giuliano
Subject: Re: SAP storms

as of Mar 19, 15:20 PDT, we're seeing some pretty big rates on the MIX from
multiple sources:

 64.251.63.188   224.2.127.254     5120K
 64.251.63.66    224.2.127.254      444K
 132.236.117.51  224.2.127.254      509K
 128.32.129.171  224.0.5.128        796K

this seems to be causing quite a bit of flapping on some peers.

-- Mark Foster
NASA Research & Engineering Network / CSC
NASA Ames Research Center

On 3/19/2010 12:44 PM, Leonard Giuliano wrote:
> Anyone notice a large rate of SAP packets the last few days?  Have seen 
> spikes up to 20Mbps of SAP.  Here's a packet from a flow seen during one 
> of the spikes.  Looks like the culprit is 131.252.176.85:
> 
> 
> 
> No.     Time        Source                Destination           Protocol 
> Info
>        1 0.000000    131.252.176.85        224.2.127.254         SAP/SDP  
> Announcement (v1), with session description
>