Subject: Filters not working

From: "Jeffrey S. Curtis" <[email-masked]>
Date: Wed, 28 Aug 1996 20:14:29 -0500

I'm not sure that the extended-IP-access-list method of filtering this
problem is working.  For example, on an AGS+ running 10.2(11) with one
dense-mode PIM interface toward the Mbone and three sparse-mode PIM
interfaces to terminal networks (no other mrouters), I have:

 access-list 173 deny   ip 0.0.0.0 255.255.255.255 239.133.130.34 0.0.0.0
 access-list 173 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255

And on each of the four PIM-speaking interfaces I have:

 ip access-list 173 in

I then do:

 clear ip mr *

And things are ok for a while.  Eventually, though (where "eventually"
is anywhere from fifteen seconds to several minutes), one of the bogus
packets gets through, and I wind up with:

 Group: 224.2.100.100, number of RPs: 1
   (0) RP: 239.133.130.34, state: Up, uptime 00:00:13, expires 0:01:46

I find it interesting that each of the several times I have cleared the
mroutes, it is *invariably* 224.2.100.100 which is the first to pop up
with the bogus RP address.  224.2.100.100 is the audio channel for the
"FreeBSD Lounge" session.  Once 224.2.100.100 comes up with the bad RP,
it starts to infect other groups much more rapidly.  I don't know whether
this helps to identify the source of the problem or is merely a
coincidence.  If it matters, here's what the mroute entry looks like for
that group when the bogus entry first appears:

 (*, 224.2.100.100), 00:01:59/0:02:54, RP 239.133.130.34, flags: SP
   Incoming interface: Fddi0, RPF neighbor 146.137.128.124
   Outgoing interface list: Null

 (17.201.41.36/32, 224.2.100.100), uptime 00:01:55, expires 0:01:00, flags: PT
   Incoming interface: Fddi0, RPF neighbor 146.137.128.124
   Outgoing interface list: Null

 (128.102.80.37/32, 224.2.100.100), uptime 00:01:59, expires 0:00:55, flags: PT
   Incoming interface: Fddi0, RPF neighbor 146.137.128.124
   Outgoing interface list: Null

 (129.213.92.2/32, 224.2.100.100), uptime 00:01:48, expires 0:01:10, flags: PT
   Incoming interface: Fddi0, RPF neighbor 146.137.128.124
   Outgoing interface list: Null

(FWIW, Dino, my entire PIM cloud is quite infected, but none of my
routers appeared on the list you just posted.)

Jeff
-- 
Jeffrey S. Curtis                      | Internetwork Manager
Argonne National Laboratory            | Email: [email-masked]
9700 South Cass Avenue, ECT-221        | Voice: 630/252-1789
Argonne, IL 60439                      | Fax:   630/252-9689

---

From: Dino Farinacci <[email-masked]>
Date: Wed, 28 Aug 1996 19:12:04 -0700

>> And on each of the four PIM-speaking interfaces I have:

    You mean "ip access-group". Did you put it also on your tunnels?

Dino