Subject: Re: error packets from Banyan servers

From: [email-masked]
Date: Wed, 19 Nov 1997 09:26:27 -0800 (PST)

> I seem to be afflicted with an old problem where some Banyan VINES
> servers on my local network are generating error packets (ICMP net
> unreachable) when they see multicast traffic.  These error packets are
> being sent back to the multicast address being used by people on the
> LAN.  I have shut down my tunnel until I can repair this. 

Thank you for doing this.  1-2 years ago, the problem was getting quite
bad.  At the moment, there doesn't seem to be much of such noise,
thanks to people such as yourself being careful about this.  Thanks,
everyone, for cleaning up most of these problems.

BTW, I have not heard of a bug with the packets being sent back to 
the multicast address.  The problem I know of is with the multicast 
packets picked up by the broken server, which then sends a unicast
ICMP port unreachable message back to the originating host.

> A search of the old mailing list archives reveals that this is an old
> problem.  However, it has not been reported lately.  There was some
> mention about a Banyan patch to correct the problem but no details.
> 
> Does anyone have information on a Banyan patch that will fix this
> problem (I know nothing about the Banyan servers)?
> 
> Another thought is to use route filtering (in mrouted 3.9Beta) to not
> allow the Banyan traffic to transit the tunnel, but I assume that the

I don't quite understand.  AFAIK, the only ICMP-related bug that 
I am aware of is that the broken host picks up multicast, thinking
it is traffic sent directly to the host, and then sends unicast ICMP 
packets from the broken host back to the host which is the source of the 
multicast.  In most cases, because of RTCP, this means everyone in
the session gets a few, which is mildly annoying.  However, the really 
painful case is at the "real" sender, which is going to get a packet 
back for every packet sent.  If you have very many hosts out there
doing this, it can result in the host dropping outbound packets,
causing the broadcast to be trashed.  On some TCP/IP protocol stacks,
even one such bogus ICMP stream has been enough to cause dropped
outbound packets. 

So, I don't see how selective multicast route filtering fits in.
What would work, would just be to filter out all traffic to/from
the Banyan server, which would stop the ICMP from being forwarded,
as well as anything else.  In the normal situation, I assume that 
such a server would only have local traffic anyway.

> error packets are still going to bounce around my local network whenever
> multicast packets are seen.  Any thoughts on this?

The 40-50 small packets per second are a completely negligible
load on the ethernet, and probably a small load on the router 
which would have to drop them (depends on the router).  However, 
in the long run, for the sake of simple network sanitation, the 
Banyan server either needs to be upgraded to a non-broken software
version or put out of its misery.

-Hugh LaMaster

Correction/additions/deletions welcome.

  Hugh LaMaster, M/S 258-5,     ASCII Email:  [email-masked]
  NASA Ames Research Center     Or:           [email-masked]
  Moffett Field, CA 94035-1000  No Junkmail:  USC 18 section 2701
  Phone:  415/604-1056          Disclaimer:   Unofficial, personal *opinion*.

---

From: [email-masked]
Date: Wed, 19 Nov 1997 14:10:03 -0800 (PST)

Steve Casner wrote:

> hope that some of the offending machines have been retired by now, but
> contrary to what Hugh LaMaster said, because of the expansion of the
> MBone I expect that there is still a lot of ICMP noise out there.  I

As some of you know, I absolutely hate characterization as 
being sanguine about such matters! ;-)  But, if things are bad,
why don't I see bogus traffic?  It may be that routing problems 
are restricting mbone connectivity right now, but, at the
moment, there is a lot of traffic out there, there appear
to be a lot of working routes to sites receiving, e.g. Shuttle, 
places around the world, etc., and, AFAIK, I am seeing exactly 
one host, bgty2.ucop.edu, send out bogus ICMP host unreachables 
(for 224.2.253.119).  

I am joined to most of the active groups, with 300-500 Kbits
of received traffic, and more importantly, 12 active senders 
and 70+ active receivers around the world, so, many of the routes 
must be up and working.  I'm sending RTCPs, which I can tcpdump,
and, I'm only getting one bogus reply (as above).

Where's the ICMP traffic?  (Are other sites getting lots
of it?  Is it being filtered by backbone routers?)

Comments/Corrections/additions/deletions more than welcome.

-Hugh LaMaster