Subject: Re: Today's MBone disaster

From: "Jeffrey S. Curtis" <[email-masked]>
Date: Wed, 28 Aug 1996 18:32:30 -0500

Dino writes:
}    Yes, you may use input access-lists. Do the following:
}
}	access-list 1 deny 239.133.130.34 0.0.0.0
}	access-list 1 permit 0.0.0.0 255.255.255.255
}
}    and for each multicast enabled interface do:
}
}	ip access-group 1 in
}
}    IP will discard packets addressed to 239.133.130.34 and prevent PIM from
}    processing the the Registers addressed to a bogus RP address.  [...]

Shouldn't this be:

	access-list 100 deny 0.0.0.0 255.255.255.255 239.133.130.34 0.0.0.0
	access-list 100 perm 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
	ip access-group 100 in

To block the register packets destined for the bogus RP address?

Jeff
-- 
Jeffrey S. Curtis                      | Internetwork Manager
Argonne National Laboratory            | Email: [email-masked]
9700 South Cass Avenue, ECT-221        | Voice: 630/252-1789
Argonne, IL 60439                      | Fax:   630/252-9689

---

From: Dino Farinacci <[email-masked]>
Date: Wed, 28 Aug 1996 16:48:13 -0700

>> To block the register packets destined for the bogus RP address?

    Yes, thank you Jeff. My suggestion filters on source address only. You
    want to filter on destination address so you need an extended access-list.
    Your syntax is correct.

    I'm sorry for the confusion.

Dino