Subject: Today's MBone disaster

From: John Hawkinson <[email-masked]>
Date: Tue, 27 Aug 1996 17:33:33 -0400 (EDT)

The MBone is currently experiencing a loop of PIM Register packets and
Register-Stop messages.

This is caused by bogus PIM join packets that cause routers to believe
that a multicast RP is valid (239.133.130.34).

This problem is resulting in a large number of data packets sent to
the multicast address 239.133.130.34, and a lot of duplicate packets
on various groups and sessions.

Unfortunately, the nature of this problem is such that any affected
PIM routers will re-infect each other.

The solutions are as follows, and we need everyone with a PIM-capable
router to implement them:

1. Don't accept any RP information for this bogus group.

In cisco-speak this is:

ip pim accept-rp 239.133.130.34 1
access-list 1 deny 0.0.0.0 255.255.255.255

You can of course use any access list other than 1.

2. Clear multicast forwarding state for all groups:

clear ip mr *

Cisco is actively working on fixing a number of bugs that have allowed
this condition to occur.

In the meantime, we will also need to track down the source of the
bogus RP information. After all PIM-capable routers have been configured
with the above, then it will be possible to determine the source by checking
log messages from routers. Eg:

%PIM-1-INVALID_RP_JOIN: Received (*, 224.2.153.62) Join from
131.119.0.196 for invalid RP 239.133.130.34

These messages will only be meaningful when all routers are "innoculated",
however.

Thanks very much to Bill Fenner, Dino Farinacci, Liming Wei, and kim
claffy, for working hard to track this problem down, and also to
Tamara Munzner for lending us her office to attack this.

--jhawk
  John Hawkinson

---

From: "David M. Meyer 541/346-1747" <[email-masked]>
Date: Tue, 27 Aug 1996 17:38:59 -0700

>> log messages from routers. Eg:

E.g., 

%PIM-1-INVALID_RP_REG: Received Register from 128.182.61.1 for 224.2.197.111, 
not willing to be RP

In addition, I can report that this problem exists in 11.1(5) and 11.2(0.20)

Dave

---

From: "Dorian R. Kim" <[email-masked]>
Date: Tue, 27 Aug 1996 23:12:27 -0400 (EDT)

> In addition, I can report that this problem exists in 11.1(5) and 11.2(0.20)

Ditto 11.1(5.0.3) synced isp-geeks code.

-dorian

---

From: 長谷川明生 <[email-masked]>
Date: Fri, 30 Aug 1996 17:48:00 +0900

Dear MBone members,

We are sorry for this problem.
One of our host is the cause of this problem.

Ordinary, our network is isolated from the MBone world.

But another experimental mbone network is joined to JP-MBone for an
experiment a few days ago, and the back door to the world is opened
and to cause this disaster.

A few minutes ago, we closed the back door also.

We are sorry for this problem.

---
                                        Nagoya University Computation Center
                                                    Akiumi Hasegawa
                                        [email-masked]
                                        Tel (052)-789-4361 Fax (052)-789-4384

---

From: 長谷川明生 <[email-masked]>
Date: Fri, 30 Aug 1996 18:33:11 +0900

>>>>> "a49915a" == a49915a  <[email-masked]> writes:

    a49915a> Dear MBone members, We are sorry for this problem.  One
    a49915a> of our host is the cause of this problem.

Sorry for incorrect information.  

Some hosts are responding "ping", but they do not send packets by that
address.

---