Subject: Re: SD packets

From: Van Jacobson <[email-masked]>
Date: Mon, 04 Mar 96 05:25:16 PST

The duplicate packets you're seeing are from a multicast routing loop
(if you did "tcpdump -v" instead of just tcpdump you'd probably notice
that the ip id's are all the same & the ttl decrements by 1 in each
new packet).  There are no duplicates from either of those sites showing
up here so the loop is probably in the path from stockholm to you.

sd sends packets at a very low rate but something like

   mtrace -S 300 habrok.uio.no 224.2.127.255

should show you where the duplicates are being generated (just
look in the last stats column for the hop where lots more
packets came out than went in).

Duplicates are usually due to a misconfigured cisco running pim
although there can be other causes.

 - Van

---

From: Petri Helenius <[email-masked]>
Date: Mon, 4 Mar 1996 18:55:13 +0200

> up here so the loop is probably in the path from stockholm to you.
The ttl decreases by three for each of the packets so the packets are
making a loop (a triangle) somewhere in the network. Unfortunately there
is one mrouted 3.3 in the way which breaks mtrace horribly:
Waiting to accumulate statistics... Results after 600 seconds:

  Source        Response Dest    Packet Statistics For     Only For Traffic
130.128.6.10    194.111.122.1    All Multicast Traffic     From 130.128.6.10
     v       __/  rtt  387 ms    Lost/Sent = Pct  Rate       To 224.2.127.255
130.128.6.10    isis.ietf.interop.net 
     v     ^      ttl   64       34/9459 =  0%  15 pps     3/15   = 20%   0 pps
128.125.1.14    mbone.usc.edu  
     v     ^      ttl   65       22/9425 =  0%  15 pps     0/12   =  0%   0 pps
204.70.170.29  
204.70.170.45   dec3800-1-fddi-1.LosAngeles.mci.net 
     v     ^      ttl   66      475/31490=  2%   0 pps     0/12   =  0%   0 pps
204.70.74.61   
204.70.74.77    dec3800-2-fddi-1.Washington.mci.net 
     v     ^      ttl   67     1905/23329=  8%   0 pps     2/12   = 17%   0 pps
204.70.64.61   
204.70.64.77    dec3800-2-fddi-1.WestOrange.mci.net 
     v     ^      ttl   68      585/60152=  1%   3 pps     0/10   = --%   0 pps
204.70.64.45   
204.70.64.29    dec3800-1-fddi-0.WestOrange.mci.net 
     v     ^      ttl   69      433/52153=  1%   5 pps     0/10   = --%   0 pps
198.67.134.250  ?              
     v     ^      ttl   70       49/63291=  0% 105 pps     0/10   = --%   0 pps
192.36.148.206  stockholm.mbone.ebone.net 
     v     ^      ttl   71          86500      144 pps       10           0 pps
128.214.1.252   directory.funet.fi 
     v     ^      ttl   72   -937513288/-937427308= --%-135721 pps  -157/0    = --%   0 pps
193.166.1.1     rip.funet.fi   
     v     ^      ttl   73    16485/85955= 19% 143 pps
192.36.148.49  
193.166.255.73  kiwi-gw.funet.fi 
     v     ^      ttl   74      707/10278=  7%  17 pps
193.166.255.74 
192.194.252.177 swallow-s2.sms.fi 
     v     ^      ttl   75      -38/1413 = -2%   2 pps
192.194.252.178
194.111.122.254 hideout-e0.sms.fi 
     v      \__   ttl   76          1415         2 pps
194.111.122.1   194.111.122.1
  Receiver      Query Source

 > packets came out than went in).
I'll first try to get the 3.3 out the path to get decent statistics.

 > although there can be other causes.

I'll try to figure out more, thanks for the pointer to look at the ttl.

Pete