Subject: RE: MBone tunnel and FreeBSD

From: Bill Fenner <[email-masked]>
Date: Tue, 14 Apr 1998 10:02:35 PDT

Unfortunately, a rate limit of 0 on a physical interface will stop
the host from receiving packets also.  Mark's solution of a discard
interface (which has to have a real subnet address so wastes address
space) is the best way to do this.

  Bill

---

From: [email-masked] (Bharadwaj Nand)
Date: Tue, 14 Apr 1998 16:54:41 -0400 (EDT)

> space) is the best way to do this.

Thx Bill and thx to all who replied so quickly. I'll do the mods to my
kernel as suggested and see how things go. 

On a slightly more wishful note what needs to be done to the kernel (other
than the mod suggested above) to realise a solution to this problem?? It
seems to me that a general solution to prevent the leakage of multicast
traffic back out would be highly desirable (such as during testing and not
wanting to flood the local subnet). 

Once again thx.

Regards
nand

---

From: [email-masked] (John A. Stewart)
Date: Tue, 14 Apr 1998 21:58:04 -856436 (EDT)

Hi Nand;

Rate levels != ttl levels. Set your ttl low, and the packets will not
escape your network. Set them low enough, and they will not escape from
the local machine.

If you don't want things to flood out, use a local ttl; (see the mrouted
manual, but with the "defaults", we use ttl 15). We sometimes crank up the 
audio, video, and who knows what, and, to our knowledge, it does not
escape. :-)

(we are temporarily down to two Mbone feeds from three - and we do test
routing, etc, between them I have not seen leaks, even when looking for
them)

Rate limits are used to try to limit the damage that one can do on a narrow
link. In an ideal world, rate limits would not exist, and ttls would be
replaced with Mark Handleys latest admin-scoping replacement, which ever 
one that is. :-)

John Stewart
[email-masked]

---

From: [email-masked] (Bharadwaj Nand)
Date: Wed, 15 Apr 1998 10:05:13 -0400 (EDT)

> > wanting to flood the local subnet). 
Hello John,

Thx for the replys. However, what I want is to limit the reception of
MBone traffic to only my mrouted machine. I don't see how I can limit the
ttl value of incoming traffic. I realise that by setting the ttl value on
sessions originating from my machine I can indeed restrict the scope of
visibility. I hope I am not missing anything here. 

To do what I am after I may indeed have to modify the kernel as suggested.

It is an interesting idea of limiting the scope of multicast traffic to
two tunnel connected mrouted machines. Conceptually this would be like a
point-to-point unicast connection (now come to think of it the tunnel is
in fact a unicast connection with the added complexity of multicast
traffic suddenly appearing, seemingly out of nowhere!!!).

I hope this discussion is not clogging up the mbone mailing list. If
anyone out there feels that this needs to be taken off line just holler on
your next reply and I'll be glad to conduct a private conversation or just
plain shutup :-).

Once again thx.

Regards,
nand