Subject: Packet duplication in SAP announcemnents

From: Mark Handley <[email-masked]>
Date: Thu, 18 Jun 1998 14:22:53 -0400

Running sdr in debug mode, I noticed that there are a lot of session
announcements getting duplicated.  The following is extracted from a
tcpdump trace.  If you're at Cisco, Gatech, KTH or Lulea, you might
want to look into the configuration of your routers.

The cisco duplicates are particularly interesting because I'm seeing
the same packet with differing TOS set.  I guess someone't
experimenting with diffserv somewhere in the loop causing these
duplicates :-)

Cheers,
	Mark

14:20:56.435243 egg.ns.gatech.edu.34491 > SAP.MCAST.NET.9875: udp 402 (ttl 8, id 47371)
14:20:56.435333 egg.ns.gatech.edu.34491 > SAP.MCAST.NET.9875: udp 402 (ttl 8, id 47371)
14:20:56.436862 egg.ns.gatech.edu.34491 > SAP.MCAST.NET.9875: udp 402 (ttl 7, id 47371)
14:20:56.439526 egg.ns.gatech.edu.34491 > SAP.MCAST.NET.9875: udp 402 (ttl 7, id 47371)

14:04:57.950593 lwei-ss20.cisco.com.3514 > SAP.MCAST.NET.9875: udp 555 [tos 0xa0] (ttl 111, id 39122)
14:04:57.959419 lwei-ss20.cisco.com.3514 > SAP.MCAST.NET.9875: udp 555 [tos 0xa0] (ttl 111, id 39122)
14:04:57.981125 lwei-ss20.cisco.com.3514 > SAP.MCAST.NET.9875: udp 555 [tos 0xa0] (ttl 111, id 39122)
14:04:58.003694 lwei-ss20.cisco.com.3514 > SAP.MCAST.NET.9875: udp 555 (ttl 110, id 39122)
14:04:58.011494 lwei-ss20.cisco.com.3514 > SAP.MCAST.NET.9875: udp 555 (ttl 111, id 39122)

14:05:01.413785 calpurnia.cc.gatech.edu.1391 > SAP.MCAST.NET.9875: udp 569 (ttl 119, id 16255)
14:05:01.414396 calpurnia.cc.gatech.edu.1391 > SAP.MCAST.NET.9875: udp 569 (ttl 119, id 16255)
14:05:01.428750 calpurnia.cc.gatech.edu.1391 > SAP.MCAST.NET.9875: udp 569 (ttl 118, id 16255)
14:05:01.430472 calpurnia.cc.gatech.edu.1391 > SAP.MCAST.NET.9875: udp 569 (ttl 118, id 16255)

14:07:05.806614 twist.it.kth.se.1033 > SAP.MCAST.NET.9875: udp 802 (ttl 114, id 59922)
14:07:05.807009 twist.it.kth.se.1033 > SAP.MCAST.NET.9875: udp 802 (ttl 113, id 4842)
14:07:05.808685 twist.it.kth.se.1033 > SAP.MCAST.NET.9875: udp 802 (ttl 109, id 4842)
14:07:05.811080 twist.it.kth.se.1033 > SAP.MCAST.NET.9875: udp 802 (ttl 109, id 4842)

14:07:11.121195 fix.cdt.luth.se.59469 > SAP.MCAST.NET.9875: udp 596 (ttl 114, id 40773)
14:07:11.141028 fix.cdt.luth.se.59469 > SAP.MCAST.NET.9875: udp 596 (ttl 111, id 40773)
...
... TTL decrements by 3 each time ....
...
14:07:11.471055 fix.cdt.luth.se.59469 > SAP.MCAST.NET.9875: udp 596 (ttl 63, id 40773)
14:07:11.490511 fix.cdt.luth.se.59469 > SAP.MCAST.NET.9875: udp 596 (ttl 60, id 40773)

14:12:40.456179 akalyur-ss20.cisco.com.40598 > SAP.MCAST.NET.9875: udp 292 (ttl 111, id 30950)
14:12:40.456745 akalyur-ss20.cisco.com.40598 > SAP.MCAST.NET.9875: udp 292 (ttl 111, id 30950)
14:12:40.498569 akalyur-ss20.cisco.com.40598 > SAP.MCAST.NET.9875: udp 292 (ttl 99, id 30950)
14:12:40.521817 akalyur-ss20.cisco.com.40598 > SAP.MCAST.NET.9875: udp
292 (ttl 102, id 30950)
...
... ttl jumps around all over, but always a multiple of three ...
...
14:12:41.167307 akalyur-ss20.cisco.com.40598 > SAP.MCAST.NET.9875: udp 292 (ttl 57, id 30950)
14:12:41.226322 akalyur-ss20.cisco.com.40598 > SAP.MCAST.NET.9875: udp 292 (ttl 72, id 30950)
14:12:41.229005 akalyur-ss20.cisco.com.40598 > SAP.MCAST.NET.9875: udp 292 (ttl 66, id 30950)

14:13:02.712254 ikluft-ss5.cisco.com.47534 > SAP.MCAST.NET.9875: udp 741 [tos 0xa0] (ttl 111, id 46160)
14:13:02.712343 ikluft-ss5.cisco.com.47534 > SAP.MCAST.NET.9875: udp 741 [tos 0xa0] (ttl 111, id 46160)
14:13:02.722055 ikluft-ss5.cisco.com.47534 > SAP.MCAST.NET.9875: udp 741 [tos 0xa0] (ttl 111, id 20660)
14:13:02.757810 ikluft-ss5.cisco.com.47534 > SAP.MCAST.NET.9875: udp 741 [tos 0xa0] (ttl 111, id 20660)
14:13:02.765286 ikluft-ss5.cisco.com.47534 > SAP.MCAST.NET.9875: udp 741 (ttl 111, id 20660)
14:13:02.779449 ikluft-ss5.cisco.com.47534 > SAP.MCAST.NET.9875: udp 741 (ttl 111, id 20660)

---

From: Tom Pusateri <[email-masked]>
Date: Thu, 18 Jun 1998 21:52:09 -0400

On a similar note, I'm seeing a frequent number of compressed session
annoncements coming from 192.32.200.117. According to ARIN, this is:

# whois -h whois.arin.net 192.32.200.0
Wellfleet Communications, Inc. (NETBLK-WELLFLEET2) WELLFLEET-NETBLK
                                                     192.32.0.0 - 192.32.255.0
Wellfleet Communications, Inc. (NETBLK-WELLFLEET1) WELLFLEET-CUST
                                                     192.32.5.0 - 192.32.253.0

The announcements are spread 2-3 seconds apart but having been coming
in steadily for at least the last half hour.

Jun 18 18:44:44 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:44:47 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:44:51 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:44:53 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:44:56 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:44:58 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:01 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:04 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:06 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:10 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:12 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:16 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:19 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:21 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0
Jun 18 18:45:24 SAP RECV 192.32.200.117 -> 224.2.127.254 via 192.32.202.66 V0 Announcement Compressed msgid 0 len 235 authlen 0