Can hardware problem make something happen? On Sat, Jul 21, 2012 at 11:38 PM, Christopher Morrow < morrowc.li...@gmail.com> wrote:
> On Sat, Jul 21, 2012 at 2:41 PM, Shahab Vahabzadeh > <sh.vahabza...@gmail.com> wrote: > > Dear Stefan, > > I have an 7206VXR Router with this design: > > > > int gig 0/1: directly connected to 3750 switch (uplink to internet) > > int gig 0/2: vlan termination from PSTN centers > > int virtual-template1: xdsl users > > > > Its about 4 days that I see near 300Mpbs outbound traffic in int gig0/1 > > that there is no such a traffic in none of routers interface, but the > same > > traffic is seen in 3750 peer interface. > > I try to run monitor session on 3750 and monitor port traffic which I see > > that packet is generating from a user and its in a loop between 3750 and > > 7206. > > I suspect that the 7206 and 3750 both thing the other guy has > default... and with no more specific to follow the packet just > pingpongs between the 2 devices. I would also suspect you see this for > more than one destination :( > > picking just one entry (last entry I see) from route-views.routeviews.org: > BGP routing table entry for 76.164.192.0/19, version 708055091 > Paths: (35 available, best #31, table Default-IP-Routing-Table) > ... > 4436 6939 53340 36114 > 69.31.111.244 from 69.31.111.244 (69.31.111.244) > Origin IGP, metric 0, localpref 100, valid, external > Community: 4436:21216 > > all of 36114(versaweb) traffic would seem to head through > 53340(vegasnap) on the way home, so... maybe something else is going > on like you didn't accept transit routes (or send them or something > else) from your transit? hard to say with as little info as we see > here, but :) > > > When I disconnect that user, I see that that packet is in loop again, > > because of that I am sure its making a loop but I do not know the reseaon > > is that packets or not. > > > > Thanks > > > > > > On Sat, Jul 21, 2012 at 11:02 PM, Stefan Fouant < > > sfou...@shortestpathfirst.net> wrote: > > > >> Can you give us more information? What do you mean it is causing Layer > 3 > >> loops? > >> > >> Stefan Fouant > >> > >> Sent from my HTC on the Now Network from Sprint! > >> > >> > >> ----- Reply message ----- > >> From: "Shahab Vahabzadeh" <sh.vahabza...@gmail.com> > >> Date: Sat, Jul 21, 2012 10:50 am > >> Subject: Attack on UDP 101 > >> To: <nanog@nanog.org> > >> > >> Hi there, > >> Does any body know any report about attack on UDP Port 101 which make > Layer > >> 3 Loops? > >> This is an example sniff: > >> > >> Source IP Address is : 76.164.199.86 > >> Source port: 62946 Destination port: 101 > >> 2012-07-21 11:11:09.646757 > >> > >> Thanks > >> > >> -- > >> Regards, > >> Shahab Vahabzadeh, Network Engineer and System Administrator > >> > >> Cell Phone: +1 (415) 871 0742 > >> PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90 > >> > >> > >> > > > > > > -- > > Regards, > > Shahab Vahabzadeh, Network Engineer and System Administrator > > > > Cell Phone: +1 (415) 871 0742 > > PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90 > -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: +1 (415) 871 0742 PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90
