Zenon, Sorry for the delay, as I was a bit overloaded.
Looking at the following link, I see that SDP/SAP is assigned the range of 224.2.0.0/16: http://www.cisco.com/en/US/tech/tk828/technologies_white_paper09186a00802d4643.shtml#wp1005088 So you can use the configuration example below to rate limit it to 100Kbps: class-map match-all SDP-SAP-MCAST match access-group name SDP-SAP-MCAST ! policy-map GENERIC-INGRESS class SDP-SAP-MCAST police 100000 ! ! Should be applied on any untrusted interface interface GigaEthernet0/1 service-policy input GENERIC-INGRESS ! ip access-list extended SDP-SAP-MCAST permit ip any 224.2.0.0 0.0.255.255 ! Actually, in your case I would recommend building a more general policy, filtering any unwanted multicast traffic. You could do it by building a longer ACL with groups which you should not be there. The link above could be a good reference. Thanks Arie -----Original Message----- From: Zenon Mousmoulas [mailto:[EMAIL PROTECTED] Sent: Sunday, June 15, 2008 23:19 PM To: Arie Vayner (avayner) Cc: Hank Nussbacher; [email protected] Subject: Re: [c-nsp] ip multicast rate-limit Last week there was an incident where high-speed video was traffic sent to the well known SAP group, which was noticed across Internet2, GEANT and other academic (multicast-enabled) networks. Many folks expressed interest to rate-limit flows to this group, as a means to protect downstream systems (apart from the standard advisory to disable "ip sap listen" etc. on routers). It so happened that I suggested this command (ip multicast rate-limit), because it (still) works for me (recently tested on a 7300 running 12.4T), but it turns out it has become obsolete, so we've been looking for functionally equivalent alternatives... Z. On 15 Ιουν 2008, at 10:54 ΜΜ, Arie Vayner (avayner) wrote: > Zenon, > > Can you please explain specifically what you want to rate limit... > Maybe a show ip mroute could be helpful... > > Arie > > -----Original Message----- > From: Zenon Mousmoulas [mailto:[EMAIL PROTECTED] > Sent: Sunday, June 15, 2008 22:48 PM > To: Arie Vayner (avayner) > Cc: Hank Nussbacher; [email protected] > Subject: Re: [c-nsp] ip multicast rate-limit > > Hi Arie, > > I would like to ask you something: > > The ip multicast rate-limit command, when used with a group-list and/ > or source-list argument, does policing on a per-mroute (S,G or > *,G) basis. This is according to relevant IOS documentation and this > document: > > ftp://ftpeng.cisco.com/ipmulticast/config-notes/multicast-rate-limit.t > xt > > The above (perhaps outdated) document suggests (in section "Status") > to use CAR for per-interface (aggregate) traffic rate-limiting, but to > keep using this command for per-mroute applications. Has this changed > since 2001? > > Could you suggest how to build a policy that would apply at per- > mroute (or higher, i.e. per-flow) granularity, instead of being > applied on the aggregate matched traffic? > > Would this sort of granular policing fall within the scope of the > microflow policing feature, which is available on some 7600 and > Catalyst 6500 hardware? > > Best regards, > Zenon Mousmoulas > GRNET > > On 14 Ιουν 2008, at 9:52 ΜΜ, Arie Vayner (avayner) wrote: > >> I suggest you try using a regular policy map, building a class with >> the traffic matched in an ACL, and apply a regular police policy on >> that class... >> Arie >> >> -----Original Message----- >> From: Hank Nussbacher [mailto:[EMAIL PROTECTED] >> Sent: Saturday, June 14, 2008 21:50 PM >> To: Arie Vayner (avayner) >> Cc: [email protected]; Zenon Mousmoulas >> Subject: RE: [c-nsp] ip multicast rate-limit >> >> On Sat, 14 Jun 2008, Arie Vayner (avayner) wrote: >> >>> Hank, >>> >>> What are you trying to achieve? >>> Can you please share "show module"? >> >> Trying to limit SAP storms. >> >> 11 0 4-subslot SPA Interface Processor-400 7600-SIP-400 >> JAE12035DJ5 >> 11/0 1xOC48 POS/RPR SPA SPA-1XOC48POS/RPR JAE11441NKV 2.3 >> Ok >> >> -Hank >> >>> >>> Thanks >>> Arie >>> >>> -----Original Message----- >>> From: [EMAIL PROTECTED] >>> [mailto:[EMAIL PROTECTED] On Behalf Of Hank >>> Nussbacher >>> Sent: Thursday, June 12, 2008 16:02 PM >>> To: [email protected] >>> Cc: Zenon Mousmoulas >>> Subject: [c-nsp] ip multicast rate-limit >>> >>> http://www.cisco.com/en/US/docs/ios/ipmulti/command/reference/ >>> imc_03.h >>> tm >>> l#wp1016097 >>> In 12.2(18)SXF11: >>> >>> petach-tikva-gp(config)#int pos11/0/0 petach-tikva-gp(config-if)#ip >>> multicast rate-limit in group-list SAP-mcast-group 1000 "ip >>> multicast rate-limit" command is not supported >>> >>> So I go to: >>> http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/ >>> 12.2SXF/ >>> na >>> tive/release/notes/OL_4164.html >>> where it says: >>> "The ip multicast rate-limit command is not supported on LAN ports. >>> (CSCds22281)" >>> >>> So what 12.2SX version supports ip multicast rate-limit on a POS >>> interface? >>> >>> Thanks, >>> Hank >>> >>> _______________________________________________ >>> cisco-nsp mailing list [email protected] >>> https://puck.nether.net/mailman/listinfo/cisco-nsp >>> archive at http://puck.nether.net/pipermail/cisco-nsp/ >>> > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
