Subject: Re: RSVP packets from invalid address

From: Mick Russell <[email-masked]>
Date: Tue, 3 Sep 1996 14:27:00 +0100

The bogus RSVP packets to the mbone were unknowingly created as a result
of placing :-

ip rsvp sender 239.27.1.56 172.25.2.73 UDP 20 30 172.25.2.73 Lo1 50 10
ip rsvp sender 239.27.1.57 172.25.2.73 UDP 20 30 172.25.2.73 Lo1 50 10
ip rsvp sender 239.27.1.58 172.25.2.73 UDP 20 30 172.25.2.73 Lo1 50 10

on a test Cisco 7000 router running gs7-i-mz.112 RSVP eft code (8/8/96).

Why did the messages escape into the mbone when the TTL needs to be
greater than 25?

As stated by Dave Pratt these multicast addresses are now filtered.

thanks
Mick Russell
 ----------
From: dave pratt
To: Petri Helenius
Cc: Mick Russell; mbone global list
Subject: Re: RSVP packets from invalid address
Date: 02 September 1996 14:25

Petri, et al

I've changed the access list on our boundary to cover all 239.x.x.x
groups,
where as previously it was stopping only 239.255.x.x groups. This should
prevent this leakage. Hopefully it wasn't too damaging.

We will also look into why these were being sent with a global ttl.

Cheers
Dave P

ps Has it been decided yet which of these is the correct administrative
scoping ?
 --------
WWW - doesn't that stand for "Wait a Week Word" ?
BEER - so much more than just a breakfast drink.
Dave Pratt      (tel: +44 1473 643840 )
[email-masked]

On Sat, 31 Aug 1996, Petri Helenius wrote:
 ->
 ->  Somebody is sending RSVP packets into the MBone with bogus IP
source
 ->addresses:
 ->Aug 31 17:26:19.719: %SEC-6-IPACCESSLOGNP: list 122 denied 46
172.25.2.73  -> 239.27.1.58, 2 packets
 ->Aug 31 17:27:19.732: %SEC-6-IPACCESSLOGNP: list 122 denied 46
172.25.2.73  -> 239.27.1.56, 2 packets
 ->
 ->  Mtrace leads into somewhere in BT.
 ->
 ->
 ->  In my opinion, it would be a good practise to filter DVMRP routes
 ->from private-use-only networks. (which would then drop the traffic)
 ->
 ->Pete
 ->

---

From: Petri Helenius <[email-masked]>
Date: Tue, 3 Sep 1996 19:26:14 +0300 (EET DST)

> As stated by Dave Pratt these multicast addresses are now filtered.
They are back!

Sep  3 19:08:53 swallow-e0 4143: Sep  3 19:08:52.590: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.57, 1 packet
Sep  3 19:08:53 swallow-e0 4144: Sep  3 19:08:52.590: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.56, 2 packets
Sep  3 19:10:53 swallow-e0 4145: Sep  3 19:10:52.614: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.58, 2 packets

Good luck :-)

Pete