Subject: Re: Reporting of 224.0.0.[2,255] groups

From: Yiqun Cai <[email-masked]>
Date: Tue, 25 Jul 2000 18:06:57 -0700 (PDT)

> 
> If the routing daemon has joined 224.0.0.2 (e.g. a multicast routing
> daemon that wants to do IGMP), then yes.

But what if the routing daemon does only OSPF, does it still join 
224.0.0.2 because it is a router? It doesn't sound like that.

> 
> >Where could it lead to a DOS attack?
> 
> If a host on a transit LAN joins the IGRP group and suddenly IGRP is
> no longer flooded but only goes to that port on the switch, that's
> a DOS attack -- it broke routing.

Got it. So the switches have to flood.

> 
> >Hence, I would say the switches should always flood packets addressed 
> >to 224.0.0.[2-255].  Vendors may choose not to do so if they want to 
> >implement specific optimizations.
> 
> That's fine; the IETF doesn't specify IGMP snooping though so there's
> no place to say that, though.
> 

Perhaps IETF should, especially since IGMPv3 is coming out and is going
to make IGMP snooping even trickier. 

> >On the other hand, routers may want to report to 224.0.0.[2-255], but
> >it is not required.
> 
> Why not require it?  It's much simpler to just require it than to
> explain and make people understand the pros and cons of implementing
> it, especially when the cons of implementing it are minimal (right?)
> 

Here are the reasons,
1. the switches have to flood regardless of whether the routers send
reports or not, not just for dealing with DOS attacks you mentioned
but for interoperating with the majority of the installed base.
2. a lot of the existing implementations don't send the reports.
3. there is no harm either way (sending or not-sending reports).

IMO, of course.

-- 
Yiqun

---

From: Bill Fenner <[email-masked]>
Date: Tue, 25 Jul 2000 17:49:22 -0700

>> Most versions of UNIX do [report these groups using IGMP], so any
>> routing daemon running on a UNIX machine will.
>
>Do they send reports to 224.0.0.2 too, just curious to know.

  Bill