Source
r/networking•
Tangence

Receiving multicast on WAN?

Hi Everyone,

This afternoon a client had really slow WAN with a massive latency to boot. Traffic shapers are in place so it had never been this bad before. Normally it gets slow, but their RDP traffic is largely unaffected so no one notices (Until lunch, anyway.).

I jump on the firewall and the issue I see is multicast coming in on WAN, then being rebroadcast to every other interface... Turns out the shapers don't account for multicast traffic. I disable multicast forwarding on the interfaces and everything comes back to normal but I just can't think of a reason why I would be receiving so much multicast traffic on my WAN link.

Of course the GM is a little annoyed and wanted to know why but I can't really tell him "We got flooded by some traffic that we really shouldn't be getting. The traffic shapers don't account for this traffic. I dont know if anything was compromised." so I figure I'd ask the fine folks here: "Why would I be getting a 20mbps stream of multicast on my WAN?"

Posted Jan 11, 2017, 4:41 AM UTC · edited

24
noukthx•

Did you get a capture of it? Could be HSRP/VRRP garbage from the next hop out.

2
TangenceOP•

I thought I did but it was only 4000 packets (Less than a second) and if I filter by "(eth.dst[0]&1)" or "ip.dst==224.0.0.0/4", which should list me all multicast traffic there's nothing...

1
Philibilly•

Question is: why was multicast enabled in the first place? Or is it the default setting on the firewall, which vendor is it?

What kind of WAN are we talking about? MPLS? Internet? Any VPN? If it is Internet, you definetly should receive any multicast traffic on the outside interface that isn't in the 224.0.0.0/24 range.

2
kWV0XhdO•

Why would I be getting a 20mbps stream of multicast on my WAN?

There's really only two possible answers to this question:

  • Somebody is sending the traffic and somebody else is subscribing to it.
  • Somebody is sending the traffic and you're running PIM in dense mode.

I know you're looking for something deeper/more meaningful, but with the level of detail you've provided about your environment (and the traffic in question), we'd be guessing.

For many networks, a 20Mb/s stream is a shocking anomaly. For many other networks, seeing only 20Mb/s means that something's broken.

Which one are you?

2