V-273590

Discussion

Real-time multicast traffic can entail multiple large flows of data. An attacker can flood a network segment with multicast packets, over-using the available bandwidth and thereby creating a denial-of-service (DoS) condition. Hence, it is imperative that register messages are accepted only for authorized multicast groups and sources.

Check Content

Check configuration for presence of accept-register filter for PIM:

ICX# show ip pim sparse
Global PIM Sparse Mode Settings
  Maximum Mcache         : 12288       Current Count              : 0
  Hello interval         : 30          Neighbor timeout           : 105
  Join/Prune interval    : 60          Inactivity interval        : 180
  Hardware Drop Enabled  : Yes         Prune Wait Interval        : 3
  Bootstrap Msg interval : 60          Candidate-RP Msg interval  : 60
  Register Suppress Time : 60          Register Probe Time        : 10
  Register Stop Delay    : 10          SPT Threshold              : 1
  SSM Enabled            : No
  Register Rate Limit    : 1 pps
  Register Filter        : PIM_REG_FILTER
  Route Precedence       : uc-non-default uc-default mc-non-default mc-default
  Join/Prune Policy      : No
  Slow Path Disable All  : No          Slow Path Enable SSM      : No
  Slow Path Filter Acl   : None

If the RP router peering with PIM-SM routers is not configured with a policy to block registration messages for any undesirable multicast groups and sources, this is a finding.