The multicast Designated Router (DR) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages it will allow for each source-group (S, G) entry.

Associated with: CCI-002385

SV-93035r1_rule The multicast Designated Router (DR) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages it will allow for each source-group (S, G) entry.

Vulnerability discussion

When a new source starts transmitting in a PIM Sparse Mode network, the DR will encapsulate the multicast packets into register messages and forward them to the RP using unicast. This process can be taxing on the CPU for both the DR and the RP if the source is running at a high data rate and there are many new sources starting at the same time. This scenario can potentially occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain.

Check content

Review the configuration of the DR to verify that it is rate limiting the number of multicast register messages. If the DR is not limiting multicast register messages, this is a finding.

Fix text

Configure the DR to rate limit the number of multicast register messages it will allow for each (S, G) entry.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.