It seems I found an explanation: http://www.ryanhicks.net/blog/2008/12/cisco-4500-intermittant-high-cpu-utilization---part-2.html
"The 4500 is capable of handling much higher volumes of multicast traffic, and it has distributed hardware processing of multicast. It turns out that the 224.0.0.0/24 range is reserved for L2 local multicast, such as routing protocols, All routers, All hosts, etc. Because of this fact, the 4500 was designed to send all multicast traffic destined to any address in this range directly to the CPU weather it was needed/subscribed, or not. I think an inbound 224.0.0.0/24 multicast filter should be considered a basic security requirement for every network in order to prevent inadvertant or intentional DoS against the switched infrastructure regardless of weather multicast is officially in use on the network! " Now my question, is this limitation specific to the 4500's ? Or does it mean that we can bring down any catalyst network with a good multicast stream ??? This is scaring... Guys, what methods do you use to control this ? Thanks. Regards, Antonio Soares, CCIE #18473 (R&S/SP) [email protected] http://www.ccie18473.net -----Original Message----- From: Antonio Soares [mailto:[email protected]] Sent: quarta-feira, 13 de Julho de 2011 15:54 To: 'Peter Rathlev'; 'Alexander Clouter' Cc: '[email protected]' Subject: RE: [c-nsp] Cat4500 High CPU with Multicast Stream It seems I need some sort of CoPP protection. I found a very nice document: Infrastructure Protection on Cisco Catalyst 6500 and 4500 Series Switches http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080825564.pdf I'm now reading the section "CoPP on Catalyst 4500". Thanks. Regards, Antonio Soares, CCIE #18473 (R&S/SP) [email protected] http://www.ccie18473.net -----Original Message----- From: Peter Rathlev [mailto:[email protected]] Sent: quarta-feira, 13 de Julho de 2011 14:20 To: Antonio Soares Cc: [email protected] Subject: Re: [c-nsp] Cat4500 High CPU with Multicast Stream On Wed, 2011-07-13 at 12:59 +0100, Antonio Soares wrote: > Usually the multicast streams are destined to 224.x.x.x. The end users do > not respect the 239 rule. Beware that traffic to 224.0.0.0/24 (Local Network Control Block) is _always_ process switched and will never be blocked by any switch. As long as these addresses are used the traffic will be punted. I could imagine that the LNCB addresses were used exactly because they're always forwarded. They might have tried using 239-addresses (Organization-Local Scope) but maybe couldn't get it to work. Typically Cisco access switches are running IGMP Snooping, and will not forward multicast traffic without either an IGMP Snooping Querier or a PIM enabled device on the VLAN (unless it's LNCB). If all traffic is intra-VLAN you could just add "ip igmp snooping querier" to the relevant SVI and move the clients to 239.x.y.z addresses. You could also block traffic to these multicast addresses on the SVIs with (hardware) ACLs. Beware that OSPF, HSRP et cetera actually use LNCB addresses, and it's probably not smart to block these. -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
