Subject: SAP.MCAST.NET spamming

From: keryell <[email-masked]>
Date: Thu, 14 May 1998 10:03:18 +0200

It looks like wd-46.lrz-muenchen.de is spamming SAP.

A "tcpdump -v -s 1000 proto ipip or igmp" shows :

10:00:27.251677 babylone.int-evry.fr > chailly: wd-46.lrz-muenchen.de.31608 > SAP.MCAST.NET.9875: udp 214 (ttl 118, id 38668) (ttl 59, id 27251)
10:00:27.267407 babylone.int-evry.fr > chailly: wd-46.lrz-muenchen.de.31608 > SAP.MCAST.NET.9875: udp 214 (ttl 118, id 38924) (ttl 59, id 27252)
10:00:27.271327 babylone.int-evry.fr > chailly: wd-46.lrz-muenchen.de.31608 > SAP.MCAST.NET.9875: udp 214 (ttl 117, id 38668) (ttl 59, id 27253)
10:00:27.282090 babylone.int-evry.fr > chailly: wd-46.lrz-muenchen.de.31608 > SAP.MCAST.NET.9875: udp 214 (ttl 117, id 38924) (ttl 59, id 27254)

The nasty side effect is a systematic core dump of sdr v2.3a1 at least
on Solaris 2.6 3/98.

-- 
    Ronan KERYELL
    Centre de Recherche en Informatique
    de l'École Nationale Supérieure des Mines de Paris (CRI-ENSMP)
    35, Rue Saint-Honoré
    77305 FONTAINEBLEAU CEDEX
    FRANCE                               Tel:    (+33|0) 1.64.69.48.44
                                         Fax:    (+33|0) 1.64.69.47.09
                                         E-mail: [email-masked]
                                         http://www.cri.ensmp.fr/~keryell

---

From: [email-masked]
Date: Thu, 14 May 1998 11:17:59 +0200 (MET DST)

We know that over here and are trying to get hold on somebody in
Munich who stops that.

##   Network Operation Center, DFN-Verein Geschaeftsstelle Stuttgart   ##
## http://www.noc.dfn.de/ finger [email-masked] [email-masked] ##
##             >>>>>>  mailto:  [email-masked]  <<<<<<               ##
##      Phone: 0711-63314-112, FAX 0711-63314-134 (business hours)     ##