Hi,
Alright. Any idea if this will work on GSRs, and on what SPAs and/or
line-cards? Or any other workaround to accomplish the same thing, for
platforms other than 6500/7600?
Thanks for the info.
Z.
On 19 Ιουν 2008, at 10:54 ΠΜ, Arie Vayner (avayner) wrote:
Zenon,
In this case you can actually use microflow policers (if you are on
6500/7600).
The link is here:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/qos.html#wp1571584
Using the following police statement (instead the one I used before)
would police each source IP to 50Kbps (not Mbps):
police flow mask src-only 50000 1500 conform-action transmit
exceed-action drop
You can also police on L4 flows by using:
police flow mask full-flow 50000 1500 conform-action transmit
exceed-action drop
Arie
-----Original Message-----
From: Zenon Mousmoulas [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 18, 2008 20:20 PM
To: Arie Vayner (avayner)
Cc: Hank Nussbacher; [email protected]
Subject: Re: [c-nsp] ip multicast rate-limit
Hi,
No problem with any delay, I'm glad you answered.
The configuration you suggest is fine but the question is (and has
been all along) whether this will police individual traffic flows or
the aggregate traffic matched by the acl? I don't know for sure, but
I believe it is more likely to be the second case.
If so, I think this could not be a sufficient solution because
someone could still effectively "drown" SAP by sending a lot of
traffic to the group, which would "compete" with the rest of the
legitimate SAP traffic for the same 100 Mbps. Furthermore, due to
the nature of SAP, letting such a high speed flow pass through the
router and reach the end systems (SAP listeners) would still have a
detrimental effect on them, since they only expect to see and
process low bitrate traffic.
For these reasons we probably need a solution that will rate-limit/
police each flow individually. The interface configuration command
"ip multicast rate-limit" used to do this, but we need something
that will work on platforms where this is not supported, and also
perhaps a more generic approach. I don't know what that solution
could be though...
I'm afraid that something could be micropolicing, which I think is
quite "expensive" and only supported on a small number of systems/
configurations.
I hope you can look into this and verify or falsify these assumptions.
Thanks again for your help.
Best regards,
Z.
On 18 Ιουν 2008, at 6:54 ΜΜ, Arie Vayner (avayner) wrote:
Zenon,
Sorry for the delay, as I was a bit overloaded.
Looking at the following link, I see that SDP/SAP is assigned the
range of 224.2.0.0/16:
http://www.cisco.com/en/US/tech/tk828/
technologies_white_paper09186a00
802d4643.shtml#wp1005088
So you can use the configuration example below to rate limit it to
100Kbps:
class-map match-all SDP-SAP-MCAST
match access-group name SDP-SAP-MCAST !
policy-map GENERIC-INGRESS
class SDP-SAP-MCAST
police 100000
!
! Should be applied on any untrusted interface interface
GigaEthernet0/1 service-policy input GENERIC-INGRESS !
ip access-list extended SDP-SAP-MCAST
permit ip any 224.2.0.0 0.0.255.255
!
Actually, in your case I would recommend building a more general
policy, filtering any unwanted multicast traffic. You could do it by
building a longer ACL with groups which you should not be there.
The link above could be a good reference.
Thanks
Arie
-----Original Message-----
From: Zenon Mousmoulas [mailto:[EMAIL PROTECTED]
Sent: Sunday, June 15, 2008 23:19 PM
To: Arie Vayner (avayner)
Cc: Hank Nussbacher; [email protected]
Subject: Re: [c-nsp] ip multicast rate-limit
Last week there was an incident where high-speed video was traffic
sent to the well known SAP group, which was noticed across Internet2,
GEANT and other academic (multicast-enabled) networks.
Many folks expressed interest to rate-limit flows to this group, as a
means to protect downstream systems (apart from the standard advisory
to disable "ip sap listen" etc. on routers). It so happened that I
suggested this command (ip multicast rate-limit), because it
(still) works for me (recently tested on a 7300 running 12.4T), but
it
turns out it has become obsolete, so we've been looking for
functionally equivalent alternatives...
Z.
On 15 Ιουν 2008, at 10:54 ΜΜ, Arie Vayner (avayner) wrote:
Zenon,
Can you please explain specifically what you want to rate limit...
Maybe a show ip mroute could be helpful...
Arie
-----Original Message-----
From: Zenon Mousmoulas [mailto:[EMAIL PROTECTED]
Sent: Sunday, June 15, 2008 22:48 PM
To: Arie Vayner (avayner)
Cc: Hank Nussbacher; [email protected]
Subject: Re: [c-nsp] ip multicast rate-limit
Hi Arie,
I would like to ask you something:
The ip multicast rate-limit command, when used with a group-list
and/
or source-list argument, does policing on a per-mroute (S,G or
*,G) basis. This is according to relevant IOS documentation and this
document:
ftp://ftpeng.cisco.com/ipmulticast/config-notes/multicast-rate-
limit.t
xt
The above (perhaps outdated) document suggests (in section "Status")
to use CAR for per-interface (aggregate) traffic rate-limiting, but
to keep using this command for per-mroute applications. Has this
changed since 2001?
Could you suggest how to build a policy that would apply at per-
mroute (or higher, i.e. per-flow) granularity, instead of being
applied on the aggregate matched traffic?
Would this sort of granular policing fall within the scope of the
microflow policing feature, which is available on some 7600 and
Catalyst 6500 hardware?
Best regards,
Zenon Mousmoulas
GRNET
On 14 Ιουν 2008, at 9:52 ΜΜ, Arie Vayner (avayner) wrote:
I suggest you try using a regular policy map, building a class with
the traffic matched in an ACL, and apply a regular police policy on
that class...
Arie
-----Original Message-----
From: Hank Nussbacher [mailto:[EMAIL PROTECTED]
Sent: Saturday, June 14, 2008 21:50 PM
To: Arie Vayner (avayner)
Cc: [email protected]; Zenon Mousmoulas
Subject: RE: [c-nsp] ip multicast rate-limit
On Sat, 14 Jun 2008, Arie Vayner (avayner) wrote:
Hank,
What are you trying to achieve?
Can you please share "show module"?
Trying to limit SAP storms.
11 0 4-subslot SPA Interface Processor-400 7600-SIP-400
JAE12035DJ5
11/0 1xOC48 POS/RPR SPA SPA-1XOC48POS/RPR JAE11441NKV
2.3
Ok
-Hank
Thanks
Arie
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Hank
Nussbacher
Sent: Thursday, June 12, 2008 16:02 PM
To: [email protected]
Cc: Zenon Mousmoulas
Subject: [c-nsp] ip multicast rate-limit
http://www.cisco.com/en/US/docs/ios/ipmulti/command/reference/
imc_03.h
tm
l#wp1016097
In 12.2(18)SXF11:
petach-tikva-gp(config)#int pos11/0/0 petach-tikva-gp(config-
if)#ip
multicast rate-limit in group-list SAP-mcast-group 1000 "ip
multicast rate-limit" command is not supported
So I go to:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/
12.2SXF/
na
tive/release/notes/OL_4164.html
where it says:
"The ip multicast rate-limit command is not supported on LAN
ports.
(CSCds22281)"
So what 12.2SX version supports ip multicast rate-limit on a POS
interface?
Thanks,
Hank
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
