Subject: Re: mboned: Re: [nesg] Multicast Detective

From: "Kevin C. Almeroth" <[email-masked]>
Date: Tue, 1 Nov 2005 10:30:43 -0800

Yes, if you set the TTL > 1, then bad things could happen.

However, sillyness ensues if everytime we try to make a change,
an improvement, or learn more about what is happening and we get
the preverbial "DoS attacks can happen".

-Kevin

>>and if you set the ttl to something > 1?
>>
>>_J
>>
>>>>> Pekka Savola <[email-masked]> 11/1/2005 12:06:46 PM >>>
>>On Tue, 1 Nov 2005, Jeremy Hall wrote:
>>...
>>> Pinging the group is just ASKING for a DOS attack.
>>
>>You may have missed the context.  The detecive is only pinging the 
>>link-local group addresses such as "all-routers on link" and "all pim 
>>routers on link".  I don't see how DoS is a concern in that very 
>>specific environment, when you'd typically get 0, 1 or at most 2 
>>responses from the same link.
>>
>>-- 
>>Pekka Savola                 "You each name yourselves king, yet the
>>Netcore Oy                    kingdom bleeds."
>>Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
>>
_______________________________________________________________
user interface: http://darkwing.uoregon.edu/~llynch/mboned.html
web archive:  http://darkwing.uoregon.edu/~llynch/mboned/

---

From: "Mike O'Connor" <[email-masked]>
Date: Tue, 01 Nov 2005 15:29:01 -0500

Routers that forward link local packets with any ttl are affectionately 
called "broken routers";)

-Mike O'Connor

-- 
Mike O'Connor,                  E-mail: [email-masked]
Network Engineer                Energy Sciences Network (ESnet)
Phone: +1 631 344-7410     
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)