Subject: igmp-4 packets from mae-east.cais.com

From: Kyungran Kang <[email-masked]>
Date: Sat, 23 Nov 1996 17:54:02 +0900 (KST)

Hello.

mae-east.cais.com are sending "igmp-4" packets to 239.133.130.34.
The packets are encapsulated.

Sessions announced by sdr don't have such address.
What the packets are for? 

Please let me know... Would you mind explaining to me?
Thanks in advance.

Kyungran Kang

---

From: Bill Fenner <[email-masked]>
Date: Sat, 23 Nov 1996 10:13:44 PST

>The packets are encapsulated.

Sounds like the PIM virus.  CAIS should upgrade their router, or at least
install the fixes.

  Bill

Subject:  Today's MBone disaster
Date:     Tue, 27 Aug 96 14:33:33 PDT
From:     John Hawkinson <[email-masked]>
To:       [email-masked], [email-masked]

The MBone is currently experiencing a loop of PIM Register packets and
Register-Stop messages.

This is caused by bogus PIM join packets that cause routers to believe
that a multicast RP is valid (239.133.130.34).

This problem is resulting in a large number of data packets sent to
the multicast address 239.133.130.34, and a lot of duplicate packets
on various groups and sessions.

Unfortunately, the nature of this problem is such that any affected
PIM routers will re-infect each other.

The solutions are as follows, and we need everyone with a PIM-capable
router to implement them:

1. Don't accept any RP information for this bogus group.

In cisco-speak this is:

ip pim accept-rp 239.133.130.34 1
access-list 1 deny 0.0.0.0 255.255.255.255

You can of course use any access list other than 1.

2. Clear multicast forwarding state for all groups:

clear ip mr *

Cisco is actively working on fixing a number of bugs that have allowed
this condition to occur.

In the meantime, we will also need to track down the source of the
bogus RP information. After all PIM-capable routers have been configured
with the above, then it will be possible to determine the source by checking
log messages from routers. Eg:

%PIM-1-INVALID_RP_JOIN: Received (*, 224.2.153.62) Join from
131.119.0.196 for invalid RP 239.133.130.34

These messages will only be meaningful when all routers are "innoculated",
however.

Thanks very much to Bill Fenner, Dino Farinacci, Liming Wei, and kim
claffy, for working hard to track this problem down, and also to
Tamara Munzner for lending us her office to attack this.

--jhawk
  John Hawkinson

---

From: Petri Helenius <[email-masked]>
Date: Sun, 24 Nov 1996 13:07:05 +0200 (EET)

> Sounds like the PIM virus.  CAIS should upgrade their router, or at least
This reminds me of another similar 'configruation flexibility' which
I've contributed to myself that I feel I should share the experience
of before too many people get burned. Starting from 11.2 FCS and
11.1(6.1) Cisco's multicast implemetation includes a wonderful and
long awaited feature of Auto-RP. This means that you can put up a
router or two announcing themselves as RP's and everybody else will
get the information and everybody will share a common RP. This works
well if you take into account a set of small things:
- DON'T LET your RP-annoucements leak out your PIM cloud. This means
  installing boundary for groups 224.0.1.39 and 224.0.1.40 on the
  router's having DVMRP tunnels and PIM neighbors
- Use 'ip pim accept-rp auto-rp' so nobody else sending you bad Joins
  or Registers don't succeed on messing up your routing

The RP-messages are scoped by TTL so setting the TTL carefully should
keep you from polluting the MBone and the boundary will keep anyone
else out there from polluting you.

What happens if you don't? Simply, everybody will start sending
registers to your RP's which will end up appearing as duplicate
packets and dropped when they try to re-enter the MBone (because of
RPF check). You'll see them inside your PIM cloud though.

This message is not intended to be read as 'PIM breaks the MBone again'
message but as an configuration advisory how not to do that.

Pete

PS. And while I'm at it, somebody who's announcing 192.0.0.0/8 to the
    MBone should stop, thank you.