Subject: MBone flood alert

From: Petri Helenius <[email-masked]>
Date: Fri, 25 Oct 1996 22:03:28 +0300 (EET DST)

Anybody know who is this guy flooding the MBone with ttl 127 packets
full of hex 0xff? 

silver:/home/pete(76)% mtrace 147.160.31.91 224.2.252.54
Mtrace from 147.160.31.91 to 194.111.122.1 via group 224.2.252.54
Querying full reverse path... 
  0  silver.sms.fi (194.111.122.1)
 -1  hideout-e0.sms.fi (194.111.122.254)  PIM  thresh^ 1   [147.160/16]
 -2  swallow-s1.sms.fi (192.194.252.177)  PIM  thresh^ 4   [default]
 -3  kiwi-gw.funet.fi (193.166.255.73)  DVMRP  thresh^ 12   [147.160.31/24]
 -4  rip.funet.fi (193.166.2.225)  DVMRP  thresh^ 12   [147.160.31/24]
 -5  stockholm.mbone.ebone.net (192.36.148.206)  DVMRP  thresh^ 40   [147.160.31/24]
 -6  icm-pen-2-F2/0.icp.net (198.67.134.250)  DVMRP  thresh^ 64   [147.160.31/24]
 -7  mae-bone.psi.net (192.41.177.247)  DVMRP  thresh^ 64   [147.160.31/24]
 -8  MBONE.SESQUI.NET (128.241.254.1)  DVMRP  thresh^ 0   [147.160.31/24]
 -9  dec3800-1-fddi-0.Dallas.mci.net (204.70.114.29)  DVMRP  thresh^ 32   [147.160.31/24]
-10  concurrent-tech-group.Houston.mci.net (204.70.37.42)  DVMRP  thresh^ 0   [147.160.31/24]
-11  fr-in.ctc.com (147.160.199.34)  PIM  thresh^ 0   [147.160.31/24]
-12  ? (147.160.31.91)
Round trip time 988 ms

Waiting to accumulate statistics... Results after 10 seconds:

  Source        Response Dest    Packet Statistics For     Only For Traffic
147.160.31.91   194.111.122.1    All Multicast Traffic     From 147.160.31.91
     v       __/  rtt  418 ms    Lost/Sent = Pct  Rate       To 224.2.252.54
147.160.31.1   
147.160.199.34  fr-in.ctc.com  
     v     ^      ttl    0       -2/1521 =  0% 152 pps    -1/1403 =  0% 140 pps
147.160.199.33 
204.70.37.42    concurrent-tech-group.Houston.mci.net 
     v     ^      ttl    1      154/1521 = 10% 152 pps   127/1404 =  9% 140 pps
204.70.114.29   dec3800-1-fddi-0.Dallas.mci.net 
     v     ^      ttl   32      149/1412 = 11%   0 pps   128/1277 = 10%   0 pps
128.241.254.1   MBONE.SESQUI.NET 
     v     ^      ttl   33      663/1966 = 34% 196 pps     0/1149 =  0% 114 pps
192.41.177.247  mae-bone.psi.net 
     v     ^      ttl   64      190/1481 = 13% 148 pps     3/1149 =  0% 114 pps
198.67.134.250  icm-pen-2-F2/0.icp.net 
     v     ^      ttl   65       -5/1954 =  0% 195 pps    -1/1146 =  0% 114 pps
192.36.148.206  stockholm.mbone.ebone.net 
     v     ^      ttl   66      -10/2325 =  0% 232 pps    -4/1147 =  0% 114 pps
193.166.6.34   
193.166.2.225   rip.funet.fi   
     v     ^      ttl   67       16/2335 =  1% 233 pps     9/1151 =  1% 115 pps
193.166.5.177  
193.166.255.73  kiwi-gw.funet.fi 
     v     ^      ttl   68     1910/1921 = 99% 192 pps   -18/1142 = -1% 114 pps
193.166.255.74 
192.194.252.177 swallow-s1.sms.fi 
     v     ^      ttl   69       -5/1194 =  0% 119 pps   -10/1160 =  0% 116 pps
192.194.252.178
194.111.122.254 hideout-e0.sms.fi 
     v      \__   ttl   70          8            0 pps       1170       117 pps
194.111.122.1   194.111.122.1
  Receiver      Query Source

Pete