Subject: (Fwd) MBone flood alert

From: "Ken Vescovi" <[email-masked]>
Date: Mon, 28 Oct 1996 09:05:03 -0500

Pete,

I have asked this individual to bring his TTL way down (4 or 5) to keep his
session local.  He is doing some local testing.

Please let me know if you continue to see a lot of traffic from this IP.

Ken

--- Forwarded mail from Petri Helenius <[email-masked]>

Date: Fri, 25 Oct 1996 22:03:28 +0300 (EET DST)
From: Petri Helenius <[email-masked]>
To: [email-masked]
Subject: MBone flood alert

  Anybody know who is this guy flooding the MBone with ttl 127 packets
full of hex 0xff?

silver:/home/pete(76)% mtrace 147.160.31.91 224.2.252.54
Mtrace from 147.160.31.91 to 194.111.122.1 via group 224.2.252.54
Querying full reverse path...
  0  silver.sms.fi (194.111.122.1)
 -1  hideout-e0.sms.fi (194.111.122.254)  PIM  thresh^ 1   [147.160/16]
 -2  swallow-s1.sms.fi (192.194.252.177)  PIM  thresh^ 4   [default]
 -3  kiwi-gw.funet.fi (193.166.255.73)  DVMRP  thresh^ 12   [147.160.31/24]
 -4  rip.funet.fi (193.166.2.225)  DVMRP  thresh^ 12   [147.160.31/24]
 -5  stockholm.mbone.ebone.net (192.36.148.206)  DVMRP  thresh^ 40
  [147.160.31/24]
 -6  icm-pen-2-F2/0.icp.net (198.67.134.250)  DVMRP  thresh^ 64
  [147.160.31/24]
 -7  mae-bone.psi.net (192.41.177.247)  DVMRP  thresh^ 64   [147.160.31/24]
 -8  MBONE.SESQUI.NET (128.241.254.1)  DVMRP  thresh^ 0   [147.160.31/24]
 -9  dec3800-1-fddi-0.Dallas.mci.net (204.70.114.29)  DVMRP  thresh^ 32
  [147.160.31/24]
-10  concurrent-tech-group.Houston.mci.net (204.70.37.42)  DVMRP  thresh^ 0
  [147.160.31/24]
-11  fr-in.ctc.com (147.160.199.34)  PIM  thresh^ 0   [147.160.31/24]
-12  ? (147.160.31.91)
Round trip time 988 ms

Waiting to accumulate statistics... Results after 10 seconds:

  Source        Response Dest    Packet Statistics For     Only For Traffic
147.160.31.91   194.111.122.1    All Multicast Traffic     From 147.160.31.91
     v       __/  rtt  418 ms    Lost/Sent = Pct  Rate       To 224.2.252.54
147.160.31.1
147.160.199.34  fr-in.ctc.com
     v     ^      ttl    0       -2/1521 =  0% 152 pps    -1/1403 =  0% 140 pps
147.160.199.33
204.70.37.42    concurrent-tech-group.Houston.mci.net
     v     ^      ttl    1      154/1521 = 10% 152 pps   127/1404 =  9% 140 pps
204.70.114.29   dec3800-1-fddi-0.Dallas.mci.net
     v     ^      ttl   32      149/1412 = 11%   0 pps   128/1277 = 10%   0 pps
128.241.254.1   MBONE.SESQUI.NET
     v     ^      ttl   33      663/1966 = 34% 196 pps     0/1149 =  0% 114 pps
192.41.177.247  mae-bone.psi.net
     v     ^      ttl   64      190/1481 = 13% 148 pps     3/1149 =  0% 114 pps
198.67.134.250  icm-pen-2-F2/0.icp.net
     v     ^      ttl   65       -5/1954 =  0% 195 pps    -1/1146 =  0% 114 pps
192.36.148.206  stockholm.mbone.ebone.net
     v     ^      ttl   66      -10/2325 =  0% 232 pps    -4/1147 =  0% 114 pps
193.166.6.34
193.166.2.225   rip.funet.fi
     v     ^      ttl   67       16/2335 =  1% 233 pps     9/1151 =  1% 115 pps
193.166.5.177
193.166.255.73  kiwi-gw.funet.fi
     v     ^      ttl   68     1910/1921 = 99% 192 pps   -18/1142 = -1% 114 pps
193.166.255.74
192.194.252.177 swallow-s1.sms.fi
     v     ^      ttl   69       -5/1194 =  0% 119 pps   -10/1160 =  0% 116 pps
192.194.252.178
194.111.122.254 hideout-e0.sms.fi
     v      \__   ttl   70          8            0 pps       1170       117 pps
194.111.122.1   194.111.122.1
  Receiver      Query Source

Pete

---End of forwarded mail from Petri Helenius <[email-masked]>

-- 

Ken Vescovi
Senior Network Engineer
Concurrent Technologies Corporation
1450 Scalp Ave
Johnstown, PA 15904			ph 814.269.2687