Subject: error packets from Banyan servers

From: Andrew Patrick <[email-masked]>
Date: Wed, 19 Nov 1997 10:51:41 -0500

I seem to be afflicted with an old problem where some Banyan VINES
servers on my local network are generating error packets (ICMP net
unreachable) when they see multicast traffic.  These error packets are
being sent back to the multicast address being used by people on the
LAN.  I have shut down my tunnel until I can repair this. 

A search of the old mailing list archives reveals that this is an old
problem.  However, it has not been reported lately.  There was some
mention about a Banyan patch to correct the problem but no details.

Does anyone have information on a Banyan patch that will fix this
problem (I know nothing about the Banyan servers)?

Another thought is to use route filtering (in mrouted 3.9Beta) to not
allow the Banyan traffic to transit the tunnel, but I assume that the
error packets are still going to bounce around my local network whenever
multicast packets are seen.  Any thoughts on this?

Thanks

-- 
Andrew Patrick, Ph.D.           
Communications Research Centre, Ottawa CANADA
E-mail: [email-masked]
WWW: http://debra.dgbt.doc.ca/~andrew
Phone: (613) 990-4675

---

From: Bill Fenner <[email-masked]>
Date: Wed, 19 Nov 1997 09:02:53 PST

>multicast packets are seen.  Any thoughts on this?

The packets that Mark Handley and I were seeing were unicast -- thus you'd
need to put filters in your unicast routers.  If it's a cisco, perhaps
something like

access-list N deny host <banyan-host> any icmp

  Bill

---

From: Andrew Patrick <[email-masked]>
Date: Wed, 19 Nov 1997 13:38:47 -0500

> access-list N deny host <banyan-host> any icmp

OK, thanks for confirming my ignorance in these issues.

---

From: Stephen Casner <[email-masked]>
Date: Wed, 19 Nov 1997 11:45:58 -0800 ()

Back in 1994, I spent part of my time trying to track down hosts that
were sending ICMP messages in response to multicast packets.  I would
hope that some of the offending machines have been retired by now, but
contrary to what Hugh LaMaster said, because of the expansion of the
MBone I expect that there is still a lot of ICMP noise out there.  I
think the condition that has changed is that more protocol stacks have
incorporated protection against receiving these illegal ICMP messages
so they don't cause the sources that are transmitting material on the
MBone to get error returns on the transmit system call.

For Andrew Patrick's benefit, here is the information I had in 1994
about patches for the Banyan Vines server.  I thought this might be in
some archived mbone list message, but it may be that I just sent
private messages to host contacts as I discovered them.  I haven't
checked any of this information since 1994.

    A patch that fixes this problem is available by ftp from csus.edu
    (or at least it was in January when I checked into it).  The fix
    is described as follows:

	TCP/IP no longer responds to ICMP messages which arrive in
	multicast addressed Ethernet packets.  SPR: 1008437.

    This is not exactly a description of the problem we see, but I gather
    that our problem is also corrected.

    There are two choices.  Patch 5.52(5)-VNS-FA-1 is a small patch fixing
    two problems, dated 02 August 1993.  It can be applied to CNS, AT,
    SMP, or MC servers running either 5.50(1) or 5.52(5).  The filename is
    /pub/banyan/patches/5525/5525fa1.zip

    The second choice is patch 5.53(0)-VNS-FY-2 dated 02 December 1993, a
    "recut" of FY-1 dated 11 November 1993.  This is a large patch fixing
    32 problems, and is listed as superseding FA-1.  It can be applied to
    the same platforms running 5.50(1), 5.52(5), or 5.53(0).  The filename
    is /pub/banyan/patches/553/553fy2.zip

    There are no references to "multicast" in the fix list for older
    versions of VINES, so if the machine in question is running an older
    version it may be necessary to upgrade first.

							-- Steve