Subject: Re: Filters not working

From: "Jeffrey S. Curtis" <[email-masked]>
Date: Wed, 28 Aug 1996 21:24:23 -0500

}    You mean "ip access-group". Did you put it also on your tunnels?

Yes, I did mean access-group.  And yes, the tunnel was the first place
I installed it.

Here's where I'm currently at: I have a leaf router which speaks
dense-mode PIM on one interface and sparse-mode PIM on another.  This
router happens to be the DR on the dense-mode network, but that's
probably irrelevant.  On this router, I have gone as full bore with
the filtering as you can get:

 access-list 173 deny   ip 0.0.0.0 255.255.255.255 239.133.130.34 0.0.0.0
 access-list 173 deny   ip 239.133.130.34 0.0.0.0 0.0.0.0 255.255.255.255
 access-list 173 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255

 int f 0
 ip access-group 173 in
 ip access-group 173 out
 int f 1
 ip access-group 173 in
 ip access-group 173 out

 clear ip mr *

(In other words, drop all traffic with the bogus RP address as either
the source or destination IP address from being accepted by or sourced
by this router on all PIM-speaking interfaces.)

It ran for five minutes without getting infected, but then the bogus
entries started showing up again.  From these results, I can only think
of two possible explanations:

	1) The extended IP access-lists are not sufficient to block
	   multicast traffic

-or-

	2) The vector for the infection does not involve the bogus RP
	   multicast address as either the source or destination IP
	   address in the packets.

Any further suggestions or comments?

Jeff
-- 
Jeffrey S. Curtis                      | Internetwork Manager
Argonne National Laboratory            | Email: [email-masked]
9700 South Cass Avenue, ECT-221        | Voice: 630/252-1789
Argonne, IL 60439                      | Fax:   630/252-9689

---

From: Bill Fenner <[email-masked]>
Date: Wed, 28 Aug 1996 18:23:15 PDT

Vague speculation:

Join messages are (I think) another vector for infection, and the PIM
Join messages don't get filtered by your input filter.  If there is
an infected router at the leaf of your network, it will send a join
towards the multicast route and of course match on default or the
gateway of last resort, which is presumably towards the router you're
playing with.

Why not try inoculating your leaf routers first, and walk up the tree,
since routers lower down might be re-infecting routers higher up with
Join messages?

  Bill