Subject: Re: Reporting of 224.0.0.[2,255] groups

From: Bill Fenner <[email-masked]>
Date: Mon, 24 Jul 2000 14:36:01 -0700

>I think 
>it really helps if implementations of RIP, OSPF or PIM that _do_ 
>send reports for the respectve groups can be made known, so that we 
>know we are trying to solve a real interoperability problem.

Most versions of UNIX do, so any routing daemon running on a UNIX machine
will.

>One way or the other, I am sure the majority of the routers deployed
>don't send reports for the routing protocols, let alone for 224.0.0.2.
>The snooping switches pretty much have to flood packets addressed to 
>these groups.

Relying on people not sending reports if you want the traffic flooded
leads to a great denial of service attack; do you want me to be able to
join IGRP-ROUTERS.MCAST.NET on my host (an unprivileged operation) and
suddenly cause IGRP peerings to go down?

If you want to avoid this attack, then switches have to be configured to
always flood.  Therefore, specifying that groups in this range are
reported does no harm.

  Bill

---

From: Yiqun Cai <[email-masked]>
Date: Tue, 25 Jul 2000 17:39:57 -0700 (PDT)

> Most versions of UNIX do, so any routing daemon running on a UNIX machine

Do they send reports to 224.0.0.2 too, just curious to know.

> suddenly cause IGRP peerings to go down?

I didn't quite get the point here. 

Routers shouldn't (or perhaps I shall say "must not") forward
packets addressed to 224.0.0.[2-255]. Where could it lead to
a DOS attack?

> always flood.  Therefore, specifying that groups in this range are

Agreed with you on the second part.

Hence, I would say the switches should always flood packets addressed 
to 224.0.0.[2-255]. Vendors may choose not to do so if they want to 
implement specific optimizations. On the other hand, routers may want 
to report to 224.0.0.[2-255], but it is not required.

I think we are converging, aren't we?

-- 
Yiqun