Subject: Excessive dvmrp routes

From: Peter Heiligers <[email-masked]>
Date: Sun, 9 Nov 1997 02:40:01 +0100 (MET)

Hello,

we get over here in Germany from our US Link
(dec3800-2-fddi-0.Washington.mci.net) since :

Nov  8 01:43:54 mr-stuttgart1.win-ip.dfn.de 142: %DVMRP-1-ROUTEHOG:
Receiving 11364 routes from 204.70.74.61 (Tunnel3) in the last 00:01:05

constantly between 8000 and 15000 dvmrp routes per min. .

Could someone please have a look at what is going on.
I can't do a lot from here, everything seems to be ok.

Thanks, Peter H.

BTW, private networks 192.168.xx./24 are also announced.

_____________________________________________________________________________
 DFN Network Operation Center, Peter Heiligers, (finger [email-masked])
                   >>>>>> mailto:  [email-masked]   <<<<<<
  Rechenzentrum Universitaet Stuttgart, Allmandring 30, D-70550 Stuttgart
         Phone: 0711-1319-102, FAX +711 6787626 (business hours)
      EMERGENCY phone +711 1319 139 with answering machine and pager
_____________________________________________________________________________

---

From: Bill Fenner <[email-masked]>
Date: Sat, 8 Nov 1997 22:37:27 PST

>From my point of view, there are between 6000 and 7000 routes in the DVMRP
routing table.  I suppose your poor Cisco must be counting individual updates
and not individual routes, and so the MBone's instability brings it up to
8000 to 15000.

For a couple of weeks, the MBone's routing table was uncharacteristically
small, between 4-5k routes.  However, on November 7th around 4PM PST, the
routing table rose back to its previous levels of 6-7k routes.  It's hard
to say if this is a "normal" event or not.  I can find and publish a list
of the new routes that were advertised at that time, but I don't have time
to try to correlate the 2000 routes to see if they are all from a particular
source.

  Bill

---

From: Peter Heiligers <[email-masked]>
Date: Sun, 9 Nov 1997 13:30:29 +0100 (MET)

> and not individual routes, and so the MBone's instability brings it up to
Yes, it should have been "between 8000 and 15000 dvmrp routing updates"
The actual dvmrp table size ist between 6900 and 7200 routes.
> to say if this is a "normal" event or not.
It didn't look normal to me. In the last hours the number of updates from the
 US slowed down to around 8500/per min.

Thanks for having a look,

Peter

>  I can find and publish a list

---

From: Bill Fenner <[email-masked]>
Date: Sun, 9 Nov 1997 13:12:51 PST

I started an mtrace to all 4200 routes that appeared in the routing
table around the time that the first jump happened.  It's not done yet,
but over half of them so far are ending up at
tm-net-telekom-malaysia.Bloomington.mci.net with the typical symptom of
Ciscos that are injecting routes but aren't configured to use them:

 -8  dec3800-1-fddi-0.Sacramento.mci.net (204.70.164.29)  DVMRP  thresh^ 1  -49 s    [4/8]
 -9  tm-net-telekom-malaysia.Bloomington.mci.net (166.48.173.250)  DVMRP  thresh^ 0  -23 s    [default]
-10  * * * * dec3800-1-fddi-1.Sacramento.mci.net (204.70.164.45) didn't respond

So, could someone please configure tm-net-telekom-malaysia.Bloomington.mci.net
to only inject routes that it's responsible for?

  Bill