[nsp] multicast flows and dev/null

[Hank Nussbacher]

Our routers continue to accumulate flows that get dumped to dev/null - all 
from 224.2.127.254.  From what I was able to determine the multicast 
sources didn't do a legitimate PIM register message to the RP in their 
domain.  Another fact is that "sh ip msdp sa-cache" doesn't show any of 
these listed so the traffic is diverted to Null:

BIU-GP0#sho ip cach flow | incl Null
AT1/1/0.34     129.105.110.208 Null           224.2.127.254   11 
00  10     119
AT1/1/0.34     130.230.52.33   Null           224.2.127.254   11 
00  10      12
AT1/1/0.34     207.75.164.245  Null           224.2.127.254   11 
00  10     224
AT1/1/0.34     171.70.152.29   Null           224.2.127.254   11 
00  10       2
AT1/1/0.34     129.116.65.3    Null           224.2.127.254   11 
00  10       6
AT1/1/0.34     130.206.1.145   Null           224.2.127.254   11 
00  10    2888
AT1/1/0.34     193.190.113.20  Null           224.2.127.254   11 
00  10    4619
AT1/1/0.34     128.59.244.235  Null           224.2.127.254   11 
00  10      69
AT1/1/0.34     131.247.105.10  Null           224.2.127.254   11 
00  10     159
AT1/1/0.34     141.163.95.2    Null           224.2.127.254   11 
00  10     125
AT1/1/0.34     141.163.95.1    Null           224.2.127.254   11 
00  10     126
AT1/1/0.34     129.49.17.194   Null           224.2.127.254   11 
00  10       1
AT1/1/0.34     150.216.193.92  Null           224.2.127.254   11 
00  10      37
AT1/1/0.34     140.192.201.124 Null           224.2.127.254   11 
00  10     161
AT1/1/0.34     140.192.200.116 Null           224.2.127.254   11 
00  10     106
AT1/1/0.34     131.128.108.14  Null           224.2.127.254   11 
00  10      17
AT1/1/0.34     131.128.108.14  Null           224.2.127.254   11 
00  10      17
AT1/1/0.34     131.128.108.15  Null           224.2.127.254   11 
00  10      71
AT1/1/0.34     193.144.36.130  Null           224.2.127.254   11 
00  10    7260
AT1/1/0.34     131.252.80.100  Null           224.2.127.254   11 
00  10      84
AT1/1/0.34     131.252.80.100  Null           224.2.127.254   11 
00  10     201
AT1/1/0.34     128.164.3.199   Null           224.2.127.254   11 
00  10       1
AT1/1/0.34     163.117.131.90  Null           224.2.127.254   11 
00  10    4371
AT1/1/0.34     131.252.176.50  Null           224.2.127.254   11 
00  10     183
AT1/1/0.34     140.192.24.123  Null           224.2.127.254   11 
00  10      13
AT1/1/0.34     150.216.6.91    Null           224.2.127.254   11 
00  10     165
AT1/1/0.34     128.205.15.244  Null           224.2.127.254   11 
00  10      10
AT1/1/0.34     141.99.80.70    Null           224.2.127.254   11 
00  10       1
AT1/1/0.34     144.173.40.242  Null           224.2.127.254   11 
00  10     120
AT1/1/0.34     144.173.40.241  Null           224.2.127.254   11 
00  10     122
AT1/1/0.34     128.114.3.67    Null           224.2.127.254   11 
00  10       1
AT1/1/0.34     128.114.3.67    Null           224.2.127.254   11 
00  10       1
AT1/1/0.34     128.32.41.25    Null           224.2.127.254   11 
00  10      57
AT1/1/0.34     163.117.69.82   Null           224.2.127.254   11 
00  10     158
AT1/1/0.34     128.223.83.33   Null           224.2.127.254   11 
00  10      21
AT1/1/0.34     140.192.70.125  Null           224.2.127.254   11 
00  10      80
AT1/1/0.34     193.144.36.134  Null           224.2.127.254   11 
00  10    1400

'sho ip cache verbose flow' results in:
SrcIf          SrcIPaddress    DstIf          DstIPaddress    Pr TOS Flgs  Pkts
Port Msk AS                    Port Msk AS    NextHop              B/Pk  Active
AT1/1/0.34     129.105.110.208 Null           224.2.127.254   11 
00  10      98
0404 /16 103                   2693 /0  0     0.0.0.0               686   970.2

Anyone else see this?  Is this normal, or something is broken along the way?

Thanks,
Hank