nanog mailing list archives
Re: Rate limiting UDP,Multicast,ICMP
From: Robert Beverly <rbeverly () rbeverly net>
Date: Tue, 13 Nov 2001 14:12:21 -0500
Rate limiting multicast packets would not have prevented state from being instantiated, nor would it have prevented the MSDP SA flooding that ensued from this worm. Some vendors provide facilities to rate limit MSDP SA messages (actually rate limiting traffic to the MSDP port 639). On Tue, Nov 13, 2001 at 06:37:41PM +0100, Niels Bakker wrote:
I'm sure that the operators of the networks that were massively hindered when some worms started scanning random hosts in 224/4 (that's what you get if you don't understand IP and just use a random number generator to get something resembling an IP address) were rate-limiting packets to multicast addresses pretty quickly. All those new sessions (one UDP packet to a multicast address) created state in lots of routers throughout their networks. Dropping TCP to 224/4 of course also helps in this particular case.
Current thread:
- Rate limiting UDP,Multicast,ICMP Thomas Gainer (Nov 13)
- Re: Rate limiting UDP,Multicast,ICMP Jared Mauch (Nov 13)
- Re: Rate limiting UDP,Multicast,ICMP Niels Bakker (Nov 13)
- Re: Rate limiting UDP,Multicast,ICMP Jared Mauch (Nov 13)
- Re: Rate limiting UDP,Multicast,ICMP Robert Beverly (Nov 13)
- Re: Rate limiting UDP,Multicast,ICMP Hank Nussbacher (Nov 14)
- Re: Rate limiting UDP,Multicast,ICMP Niels Bakker (Nov 13)
- Re: Rate limiting UDP,Multicast,ICMP Jared Mauch (Nov 13)
- <Possible follow-ups>
- Rate limiting UDP,Multicast,ICMP Thomas Gainer (Nov 13)
- Re: Rate limiting UDP,Multicast,ICMP Ian Cooper (Nov 13)
- Re: Rate limiting UDP,Multicast,ICMP David Schwartz (Nov 14)
- Re: Rate limiting UDP,Multicast,ICMP Brian (Nov 15)