Subject: Re: RSVP packets from invalid address

From: [email-masked]
Date: Tue, 3 Sep 96 09:41:27 PDT

*> From [email-masked] Tue Sep  3 09:28:46 1996
  *> Date: Tue, 3 Sep 1996 19:26:14 +0300 (EET DST)
  *> From: Petri Helenius <[email-masked]>
  *> To: Mick Russell <[email-masked]>
  *> Cc: mbone global list <[email-masked]>,
  *>         "[email-masked]" <[email-masked]>,
  *>         Dave Pratt <[email-masked]>
  *> Subject: Re: RSVP packets from invalid address
  *> In-Reply-To: <c=GB%a=_%p=BT%l=HARRYNET/PCSMTPHUB/[email-masked]>
  *> References: <c=GB%a=_%p=BT%l=HARRYNET/PCSMTPHUB/[email-masked]>
  *> Content-Length: 1028
  *> X-Lines: 24
  *> 
  *> Mick Russell writes:
  *>  > The bogus RSVP packets to the mbone were unknowingly created as a result
  *>  > of placing :-
  *>  > 

I am sorry to be stupid, but you are going to have to explain this to
me carefully.  Just exactly what IS a "bogus RSVP packet", and how do you
know it is bogus?

Bob Braden

  *>  > ip rsvp sender 239.27.1.56 172.25.2.73 UDP 20 30 172.25.2.73 Lo1 50 10
  *>  > ip rsvp sender 239.27.1.57 172.25.2.73 UDP 20 30 172.25.2.73 Lo1 50 10
  *>  > ip rsvp sender 239.27.1.58 172.25.2.73 UDP 20 30 172.25.2.73 Lo1 50 10
  *>  > 
  *>  > on a test Cisco 7000 router running gs7-i-mz.112 RSVP eft code (8/8/96).
  *>  > 
  *>  > Why did the messages escape into the mbone when the TTL needs to be
  *>  > greater than 25?
  *>  > 
  *>  > As stated by Dave Pratt these multicast addresses are now filtered.
  *>  >
  *> They are back!
  *> 
  *> Sep  3 19:08:53 swallow-e0 4143: Sep  3 19:08:52.590: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.57, 1 packet
  *> Sep  3 19:08:53 swallow-e0 4144: Sep  3 19:08:52.590: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.56, 2 packets
  *> Sep  3 19:10:53 swallow-e0 4145: Sep  3 19:10:52.614: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.58, 2 packets
  *> 
  *> Good luck :-)
  *> 
  *> Pete
  *>

---

From: Bill Fenner <[email-masked]>
Date: Tue, 3 Sep 1996 11:50:54 PDT

In message <[email-masked]> you write:
>Just exactly what IS a "bogus RSVP packet", and how do you
>know it is bogus?

Bob,

  I think that people were using "bogus RSVP packet" in their text to
abbreviate for "RSVP packet from invalid address" as stated in the
subject.  I'm sure that the RSVP packets are probably valid ones,
they're just from non-globally-routable IP sources to administratively-
scoped group addresses.

  Bill

---

From: Petri Helenius <[email-masked]>
Date: Tue, 3 Sep 1996 23:29:54 +0300 (EET DST)

> me carefully.  Just exactly what IS a "bogus RSVP packet", and how do you
Everything in the global internet having a source address of
0/8, 10/8, 127/8, 172.16/12, 192.168/16 or 224/4 should be considered
bogus.

A short exerpt from RFC1918:
>   Because private addresses have no global meaning, routing information
>   about private networks shall not be propagated on inter-enterprise
>   links, and packets with private source or destination addresses
>   should not be forwarded across such links. Routers in networks not
>   using private address space, especially those of Internet service
>   providers, are expected to be configured to reject (filter out)
>   routing information about private networks. If such a router receives
>   such information the rejection shall not be treated as a routing
>   protocol error.

For usage guidelines for the private address space please refer to
RFC1918.

Pete