Subject: Re: mboned: Re: [nesg] Multicast Detective

From: Jeremy Hall <[email-masked]>
Date: Tue, 1 Nov 2005 08:46:36 -0500 (EST)

Hi Kevin,

In the new year, Kevin C. Almeroth wrote:
> 
> Mike, the first problem is a typo...  that will be fixed.
> 
> We've discovered that juniper routers don't respond to pings...
> we need to fix that in the code.  We should say that we are
> pinging a number of multicast groups which routers should
> respond to.  If there is no answer, it doesn't necessarily
> mean multicast isn't working.
> 
I think pinging a multicast group is just entirely evil.  If you want to 
determine whether it is working or not you need a bidirectional channel 
with which you can communicate from end to end.  This violates some of my 
principals because just because you can talk to me doesn't mean I can talk 
to you ro should be able to.  If the transmitting entity is from the TOC, 
the receiver either gets it or doesn't.  Do you think the control centre 
at Dish Network cares if I receive their signal? Just like a lot of 
variables go into play on dish alignment, cloud cover, line of sight, 
trees, and other obstructions, it is difficult to determine at a glance 
where the problem might be.

Pinging the group is just ASKING for a DOS attack.

_J
_______________________________________________________________
user interface: http://darkwing.uoregon.edu/~llynch/mboned.html
web archive:  http://darkwing.uoregon.edu/~llynch/mboned/

---

From: John Kristoff <[email-masked]>
Date: Tue, 1 Nov 2005 08:36:45 -0600

On Tue, 1 Nov 2005 08:46:36 -0500 (EST)

> Pinging the group is just ASKING for a DOS attack.

Indeed.  Depending on your connectivity to the multicast-enabled
Internet and if you know the "right" group to ping, you can get
over 2500 responses from a single echo request.  Since many of the
hosts in that group are attached to very well connected networks,
it could be painful especially if the source could be spoofed.

By way of a hint, Cisco should consider giving us a knob that disables
multicast echo replies.

John

---

From: Pekka Savola <[email-masked]>
Date: Tue, 1 Nov 2005 19:06:46 +0200 (EET)

On Tue, 1 Nov 2005, Jeremy Hall wrote:
...
> Pinging the group is just ASKING for a DOS attack.

You may have missed the context.  The detecive is only pinging the 
link-local group addresses such as "all-routers on link" and "all pim 
routers on link".  I don't see how DoS is a concern in that very 
specific environment, when you'd typically get 0, 1 or at most 2 
responses from the same link.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
_______________________________________________________________
user interface: http://darkwing.uoregon.edu/~llynch/mboned.html
web archive:  http://darkwing.uoregon.edu/~llynch/mboned/