Subject: Re: Lots of DVMRP routes *still*!!! (was Re: Lots of DVMRP routes again )

From: Danny McPherson <[email-masked]>
Date: Wed, 05 Aug 1998 17:37:16 -0700

"kill -USR1 <mrouted.pid>" will dump the internal routing 
tables.  They should be able to dump the tables and look at
metric associated with some of the bogus routes to track it
back.  It's all relatively trivial, assuming someone with
access to their DECs is looking at it ;-)

Although I haven't actually looked at the problem to verify 
that MCI is the source, I've cc'd their mbone and ops folks
so that they can have a look.  After all, I'd guess that not all
of the folks that have the ability to correct this problem, or
at least down the associated source tunnel, read this list on a 
regular basis.

-danny

"Tony Tauber" wrote:
>On Aug 5, 10:57am, Hugh LaMaster wrote:
>> Subject: Lots of DVMRP routes *still*!!! (was Re: Lots of DVMRP routes aga
>>
>> Anybody out there working on this?  It is pretty amazing that
>> this has been going on for a week with only occasional relief.
>> This should be a simple fix, but, the person who has done it
>> is probably not aware.  This is where it would be nice if
>> the upstream sources could determine where the problem is
>> and cut off the tunnels until it is resolved.
>>
>> **  #date -u
>>      Wed Aug  5 17:38:58 GMT 1998
>>
>>
>> Still getting these, just as bad as before:
>>
>> Aug  5 17:41:09 UTC: %DVMRP-1-ROUTEHOG: Receiving 13097 routes
>> Aug  5 17:41:09 UTC: %DVMRP-1-ROUTEHOG: Receiving 12240 routes
>> Aug  5 17:41:09 UTC: %DVMRP-1-ROUTEHOG: Receiving 13542 routes
>>
>
>These messages should include a peer address/interface, right?
>Which provider are you getting these from?
>
>I'm seeing 'em from MCI and from another connection which also
>appears to have a tunnel to MCI.  Embarassingly enough, I think
>they've been going on for much more than a week, so maybe there's
>some different problem.
>
>Anyone have more info?  Not sure how this may visible on an
>mrouted box (vs. a Cisco) as I believe MCI uses mrouted.
>
>Tony
>
>>
>> On Tue, 4 Aug 1998, Hugh LaMaster wrote:
>>
>> > On Fri, 31 Jul 1998, Hugh LaMaster wrote:
>> >
>> > > We seem to have a huge number of routes today.  Anybody just turn
>> > > on PIM on a router with lots of unicast routes and use the
>> > > ip dvmrp metric command to get your routes into DVMRP?  Forget
>> > > to put an access-list on?
>> > >
>> > > Since the person who did it is probably too busy right now to read
>> > > email, anybody figure out where it is coming from?
>> >
>> > Same story again:
>> >
>> > Aug  4 23:57:53 UTC: %DVMRP-1-ROUTEHOG: Receiving 18235 routes
>>
>>
>> The problem is certain to be someone who recently has turned
>> on native PIM and is redistributing the PIM routes into DVMRP
>> using [assuming it is a Cisco router]:
>>
>>  ip dvmrp metric 1
>>  ^^^^^^^^^^^^^^^^^
>>
>> Normally, this should be:
>>
>>  ip dvmrp metric 1 list <acl>
>>
>> where the <acl> is an explicit list of the local routes that are
>> being injected, and which should be short list of the local
>> networks being included.
>>
>>
>> Comments/corrections/refutations welcome.
>>
>> -Hugh LaMaster
>>
>>
>> --
>>  Hugh LaMaster, M/S 233-21,    ASCII Email: [email-masked]
>>  NASA Ames Research Center     Or:          [email-masked]
>>  Moffett Field, CA 94035-1000  No Junkmail: USC 18 section 2701
>>  Phone: 650/604-1056           Disclaimer:  Unofficial, personal *opinion*.
>>
>>-- End of excerpt from Hugh LaMaster
>
>

---

From: Bill Fenner <[email-masked]>
Date: Wed, 5 Aug 1998 18:00:26 PDT

In message <[email-masked]> you write:
>It's all relatively trivial, assuming someone with

It's actually completely non-trivial, since these routes are all
extremely unstable.  This is partly because of "dvmrp route-limit"s -
they save individual routers but make the system less stable as a whole.
It's also presumably because the router that's advertising the routes
only advertises them until it hears them back again as described in
http://ganef.cs.ucla.edu/~masseyd/Route/bugs.html#CiscoUnicast .

  Bill

---

From: Doug Pasko <[email-masked]>
Date: Thu, 06 Aug 1998 10:21:02 -0400

As of 10:30 EDT, we have 8700 routes.  I will keep checking it
throughout the day.

Doug Pasko
MCI Internet Engineering