All things related to multicast

[Pekka Savola <>]

Hi,

We have an MSDP source-active limit configured for 900 (threshold), 
1000 limit.  This means one IP is allowed to create a pretty big 
number of SAs.

Since 2010-03-19, this limit has been triggered multiple times, dozens of 
times a day, though.

Has anyone else seen this?  Noticed the culprit?

........

FWIW, below is a list of those MSDP originators that at one point in time 
seemed to originate more than 100 SAs.  Most of these seems to be scanning 
and other junk:

    635 194.160.8.1
    418 130.186.23.54
    411 128.120.0.2
    381 130.206.206.247
    235 128.120.0.1
    189 141.142.12.1
    180 87.236.208.254
    174 193.166.255.241
    172 155.58.195.249
    148 128.39.65.96
    147 194.66.27.1
    144 195.113.68.1
    135 130.239.0.102
    117 194.160.8.7
    103 204.90.50.240

These are those sources which originated more than 50 SAs at one point in 
time, most of these seem like junk as well:

    356 130.186.18.157
    256 169.237.129.235 (doesn't even have inet.2 route)
    221 158.42.231.147
    147 141.142.6.8
     74 62.61.128.220
     74 195.194.48.209

I was thinking of contacting the admins of these IPs but the effort seems 
futile :-(

The numbers would likely be much uglier if I wasn't already basically 
filtering everything except 224/8 and 233/8.