[Xorp-users] Re: Newbie Xorp & m'cast problem

[edrt]

>> >> [ 2005/06/07 17:29:02  ERROR xorp_fea:16848 MFEA +1340 
>> >> mfea_proto_comm.cc proto_socket_read ] proto_socket_read() failed: 
>> >> invalid unicast sender address: 0.0.0.0
>> > 
>> > Those "invalid unicast sender address: 0.0.0.0" messages are odd.
>> > Do you run a sender or a receiver on the same box as the XORP
>> > router?
>> > In any case, please run tcpdump on all network interfaces and try to
>> > catch if there are any IP packets that have indeed source address of
>> > 0.0.0.0.
>> 
>> 	I had a very large TCPDUMP with several packets sourced from 0.0.0.0
>> 
>> 	I deleted it already, but if I remember correctly, the suspicious 
>> packets has been IGMP leave messages sent to ALL-ROUTERS GROUP.
>> 
>> 	I have the only example of it now:
>> 
>> 00:28:51.713070 0.0.0.0 > ALL-ROUTERS.MCAST.NET: igmp leave 227.11.22.33 
>> [tos 0xc0]  [ttl 1]
>
>Later Mark ran tcpdump and I think his src=0.0.0.0 packets also were
>"IGMP leave" messages. I don't know whether he found by the MAC
>address where the messages came from.
>
>> 
>> 	I have no MAC so I don't know the exact source of it.
>> 
>> 	They sems to be sent sometime by hosts which lost the IP (DHCP renewal 
>> expired, for example) or shutting down.
>
>This is an interesting observation.
>If the DHCP renewal expired, and if the IP stack removed the IP
>address before it sent the IGMP leave message, then the IGMP leave
>message may indeed appear from 0.0.0.0.
>
>Looks like a bug in the particular IP stack implementation, and it
>would be interesting to find the OS(es) with such behavior.
>

I've once observed a popular vendor's router sometimes generate IGMP
message with source address 0.0.0.0, may be the router's image needs an
upgrade :)


Eddy