Subject: Unicast routing injection (again)

From: Mark Handley <[email-masked]>
Date: Fri, 10 Jan 1997 14:19:40 -0500

Looks like someone is injecting unicast routes into DVMRP routing
tables again.  

laphroaig.cs.ucl.ac.uk is reporting:
Multicast Routing Table (36039 entries)

Unfortunately I can't get any useful mtraces to discover where they're
coming from...

Mark

---

From: Bob Van Valzah <[email-masked]>
Date: Fri, 10 Jan 1997 14:21:47 -0600

>Looks like someone is injecting unicast routes into DVMRP routing

This seems to happen a lot.  I know it's annoying me--is it annoying others
too?  I get the impression that there's no work going on to prevent it from
happening again.  Please straighten me out if I'm wrong.

My ciscos all inserted "ip dvmrp route-limit 7000" apparently to keep me
from spreading such routes.  Can the same technique be used with mrouted?

Am I correct in concluding that there's some good reason why it can't
easily be prevented?  Where can I go to read up on why it can't be easily
prevented?

	Thanks,

	Bob

---

From: "Dorian R. Kim" <[email-masked]>
Date: Fri, 10 Jan 1997 17:31:55 -0500 (EST)

It looks to be happening at mbone-pim.st-and.ac.uk. Could someone upstream
from this box verify and shut it down until the problem is fixed? Thnks.

-dorian

dgx>mtrace 12.1.1.1
Type escape sequence to abort.
Mtrace from 12.1.1.1 to 131.103.22.129 via group 224.2.0.1
>From source (?) to destination (dgx-hssi1-0-0.chicago.cic.net)
Querying full reverse path...
 0  dgx-hssi1-0-0.chicago.cic.net (131.103.22.129)
-1  dgx-hssi1-0-0.chicago.cic.net (131.103.22.129) DVMRP  thresh^ 1  2315 ms
-2  dec3800-1-fddi-1.WillowSprings.mci.net (204.70.104.45) DVMRP  thresh^ 64
227673 ms
-3  dec3800-2-fddi-1.Denver.mci.net (204.70.152.77) DVMRP  thresh^ 1  -244891
ms
-4  dec3800-2-fddi-0.WestOrange.mci.net (204.70.64.61) DVMRP  thresh^ 1  9673
ms
-5  dec3800-2-fddi-1.Washington.mci.net (204.70.74.77) DVMRP  thresh^ 1
-30875 ms
-6  mae-bone.psi.net (192.41.177.247) DVMRP  thresh^ 64  -9420 ms
-7  r-jusren.reseau.jussieu.fr (192.44.54.126) DVMRP  thresh^ 64  2418 ms
-8  fmroute1-1.exp.edf.fr (192.70.92.133) DVMRP  thresh^ 32  258650 ms
-9  mbone.cern.ch (192.65.185.20) DVMRP  thresh^ 64  2831 ms
-10 broodjeham.surfnet.nl (192.87.106.102) DVMRP  thresh^ 48  -153417 ms
-11 mbone.ulcc.ja.net (193.63.94.99) DVMRP  thresh^ 48  -90001 ms
-12 mbone.ed.ja.net (193.63.106.99) DVMRP  thresh^ 24  -6247 ms
-13 noc.ed.ja.net (193.63.106.100) DVMRP  thresh^ 1  2560 ms
-14 mbone-pim.st-and.ac.uk (138.251.65.199) Proto 0  thresh^ 24  2572 ms  No
route

-dorian

---

From: Mark Handley <[email-masked]>
Date: Fri, 10 Jan 1997 17:54:31 -0500

>from this box verify and shut it down until the problem is fixed? Thnks.

It looks like it isn't St Andrews injecting the routes (unless they've
fixed it now) - they're just injecting default which was confusing the
diagnosis :-(

Mark

---

From: "Dorian R. Kim" <[email-masked]>
Date: Fri, 10 Jan 1997 18:01:13 -0500 (EST)

> fixed it now) - they're just injecting default which was confusing the

Lovely... from my corner of the world, it looks like problem has gone away.. 

dgx>sh ip dv r
DVMRP Routing Table - 3450 entries

-dorian

---

From: Bill Fenner <[email-masked]>
Date: Fri, 10 Jan 1997 18:18:35 PST

In message <v03100d01aefc51c15c0c@[207.1.192.68]> you write:
>Where can I go to read up on why it can't be easily prevented?

The MBone mailing list archives (ftp.isi.edu:/mbone/mbone.mail)
is probably the best place.  The first event happened on April
7, 1994, and there is a burst of discussion then and periodically
since then.

  Bill