Subject: yet another route explosion

From: [email-masked] (Axel Clauberg)
Date: Thu, 27 Jun 1996 11:28:42 +0200

It seems that someone is injecting a full unicast routing table
into the mbone, again...
I received the first route-hog message at 9:08 UTC. Currently,
my routing table has around 21K entries.
Unfortunately, I can't mtrace due to a small Cisco IOS problem
(which is already being worked on...), so I can't investigate
where this is caused.
There's a high chance that someone messed up a Cisco config again
(or, to make Dino happy, someone simply changed the mrouted code to 
do something malicious, but, ... ;-)).

Axel

---

From: Scott Mace <[email-masked]>
Date: Thu, 27 Jun 1996 11:45:41 -0500 (CDT)

Here's an mtrace of a dvmrp route that's probably a bogon.

Mtrace from 10.0.0.1 to 206.109.4.50 via group 224.2.0.1
Querying full reverse path... 
  0  crash.ops.NeoSoft.COM (206.109.4.50)
 -1  crash.ops.NeoSoft.COM (206.109.4.50)  DVMRP  thresh^ 1  
 -2  core1-fe1-0.hou.neo.net (206.109.1.252)  DVMRP  thresh^ 64  
 -3  dec3800-1-fddi-1.Dallas.mci.net (204.70.114.45)  DVMRP  thresh^ 64  
 -4  dec3800-1-fddi-1.LosAngeles.mci.net (204.70.170.45)  DVMRP  thresh^ 1  
 -5  dec3800-2-fddi-0.SanFrancisco.mci.net (204.70.158.61)  DVMRP  thresh^ 1  
 -6  mbone.nsi.nasa.gov (192.203.230.241)  DVMRP  thresh^ 64  
 -7  mbone2.nsi.nasa.gov (192.203.230.242)  DVMRP  thresh^ 1  Next router no mtrace
 -8  mae-west.geonet.net (198.32.136.24) [cisco 10.3] doesn't support mtrace
Round trip time 1169 ms

Waiting to accumulate statistics... Results after 9 seconds:

  Source        Response Dest    Packet Statistics For     Only For Traffic
   * * *        206.109.4.50     All Multicast Traffic     From 10.0.0.1
     v       __/  rtt 1091 ms    Lost/Sent = Pct  Rate       To 224.2.0.1
192.203.230.242 mbone2.nsi.nasa.gov 
     v     ^      ttl    1       -3/423  =  0%  47 pps     0/0    = --%   0 pps
192.203.230.241 mbone.nsi.nasa.gov 
     v     ^      ttl   64       27/493  =  5%  54 pps     0/0    = --%   0 pps
204.70.158.61   dec3800-2-fddi-0.SanFrancisco.mci.net 
     v     ^      ttl   65        4/537  =  1%   0 pps     0/0    = --%   0 pps
204.70.170.29  
204.70.170.45   dec3800-1-fddi-1.LosAngeles.mci.net 
     v     ^      ttl   66       13/582  =  2%   0 pps     0/0    = --%   0 pps
204.70.114.29  
204.70.114.45   dec3800-1-fddi-1.Dallas.mci.net 
     v     ^      ttl   67        0/109  =  0%   0 pps     0/0    = --%   0 pps
206.109.1.252   core1-fe1-0.hou.neo.net 
     v     ^      ttl   68        0/108  =  0%  12 pps     0/0    = --%   0 pps
206.109.4.50    crash.ops.NeoSoft.COM 
     v      \__   ttl   69          0            0 pps       0            0 pps
206.109.4.50    206.109.4.50
  Receiver      Query Source

	Scott
-- 
[email-masked] - KC5NUA - Scott Mace - Network Engineer - Neosoft Inc.
Any opinions expressed are mine.

---

From: Dave Thaler <[email-masked]>
Date: Thu, 27 Jun 1996 12:55:57 -0400 (EDT)

> Unfortunately, I can't mtrace due to a small Cisco IOS problem

Looks like it lasted about an hour, and then started up again at
around 16:00 UTC (and is still broken).

Dave