Subject: Cisco Image

From: Tech Support <[email-masked]>
Date: Tue, 17 Sep 1996 16:34:57 +0000 (GMT)

Could someone plse re-post the URL of the ftp for Cisco Image for Cisco 
4500 to fix multicast flaps.

Thanks

Mike O'BradY

---

From: Yozo Toda <[email-masked]>
Date: Wed, 18 Sep 1996 23:39:29 +0900

> 4500 to fix multicast flaps.

I suppose you want the following...   -- yozo.

Subject: [[email-masked]: Today's MBone disaster]
From: Dino Farinacci <[email-masked]>
To: [email-masked], [email-masked], [email-masked]
Date: Wed, 28 Aug 1996 15:14:48 -0700

    I have a fix for this problem. You can get the image from

        ftp://ftpeng.cisco.com/ftp/dino/bogus-rp/c4500-i-mz

    If you don't use this image, you must use the workaround Jhawk describes
    below so you are not infected. This need go into your multicast routers 
    only.

    If you are doing sparse-mode PIM already and have "ip pim accept-rp"
    commands configured for RPs at your site, you probably were not infected
    and need not do anything.

    If you want other image types, please let me know what you need. However,
    before asking, please check the bogus-rp directory first to see if I
    already have made the one you need available.

    This fix will be integrated into the next 11.0, 11.1, and 11.2 releases.
    When I know the exact release numbers, I will tell you.

Dino

------------------------------------------------------------------------

Date: Tue, 27 Aug 1996 17:33:33 -0400 (EDT)
To: [email-masked], [email-masked]
Subject: Today's MBone disaster
From: John Hawkinson <[email-masked]>

The MBone is currently experiencing a loop of PIM Register packets and
Register-Stop messages.

This is caused by bogus PIM join packets that cause routers to believe
that a multicast RP is valid (239.133.130.34).

This problem is resulting in a large number of data packets sent to
the multicast address 239.133.130.34, and a lot of duplicate packets
on various groups and sessions.

Unfortunately, the nature of this problem is such that any affected
PIM routers will re-infect each other.

The solutions are as follows, and we need everyone with a PIM-capable
router to implement them:

1. Don't accept any RP information for this bogus group.

In cisco-speak this is:

ip pim accept-rp 239.133.130.34 1
access-list 1 deny 0.0.0.0 255.255.255.255

You can of course use any access list other than 1.

2. Clear multicast forwarding state for all groups:

clear ip mr *

Cisco is actively working on fixing a number of bugs that have allowed
this condition to occur.

In the meantime, we will also need to track down the source of the
bogus RP information. After all PIM-capable routers have been configured
with the above, then it will be possible to determine the source by checking
log messages from routers. Eg:

%PIM-1-INVALID_RP_JOIN: Received (*, 224.2.153.62) Join from
131.119.0.196 for invalid RP 239.133.130.34

These messages will only be meaningful when all routers are "innoculated",
however.

Thanks very much to Bill Fenner, Dino Farinacci, Liming Wei, and kim
claffy, for working hard to track this problem down, and also to
Tamara Munzner for lending us her office to attack this.

--jhawk
  John Hawkinson

---

From: Tech Support <[email-masked]>
Date: Thu, 19 Sep 1996 08:50:02 +0000 (GMT)

Many thanks to all who re-posted the URL of CISCO image. Works a treat.

Now All I need is a UK feed for MBONE!! Anyone got any hints or know who 
can give me a UK feed?

We have our own connection to US (768K and 128K) but would rather not use 
that for MBONE. 

Rgds
Mike O'BradY