Re: Attacking on Source Port 0 (ZERO)

2012-10-15 Thread Steven Noble
Roland, Sent from my iPhone On Oct 15, 2012, at 7:47 PM, "Dobbins, Roland" wrote: > I know all about the forwarding capabilities of modern general-purpose CPUs, > ring-buffers, et. al. I know what is possible, and what isn't possible. And > please, no more from the Vyatta crowd, et. al. - t

Re: Attacking on Source Port 0 (ZERO)

2012-10-15 Thread Dobbins, Roland
On Oct 16, 2012, at 8:57 AM, Ryan Malayter wrote: > 10G+ forwarding with minimum packet sizes is possible on a single core using > optimized kernels (see Intel DPDK and PF_RING DNA). Of course it isn't. You can *approach* 10gb/sec with multiple cores and minimum packet sizes, granted. > You

Re: Attacking on Source Port 0 (ZERO)

2012-10-15 Thread Ryan Malayter
On Oct 14, 2012, at 9:02 PM, "Dobbins, Roland" wrote: > > Hopefully, you have hardware-based edge devices, not just software-based > devices and (awful) stateful firewalls - the days of software-based devices > on the Internet were over years ago. Software forwarding is usually only a probl

Re: Attacking on Source Port 0 (ZERO)

2012-10-14 Thread Scott Weeks
--- sh.vahabza...@gmail.com wrote: From: Shahab Vahabzadeh It was TCP and I think it was not a DDoS attack because the traffic was not heavy. --- Many/most DoS attacks do not push up the traffic levels considerably. You can see this when looking at packet per sec

Re: Attacking on Source Port 0 (ZERO)

2012-10-14 Thread Dobbins, Roland
On Oct 15, 2012, at 3:57 AM, Nick Hilliard wrote: > If you haven't already configured CoPP on your BRASs, you might want to look > at deploying it. CoPP is pretty much a wash on software-based boxes; it only really helps on hardware-based boxes. And iACLs is easier/a bigger win, anyways (thou

Re: Attacking on Source Port 0 (ZERO)

2012-10-14 Thread Dobbins, Roland
On Oct 15, 2012, at 2:59 AM, Shahab Vahabzadeh wrote: > I think it act like a warm or some attacks which cause high CPU load in some > IOS. i.e., a DDoS attack. You should configure iACLs at your edge so that random sources on the Internet can't packet your routers. Hopefully, you have hardw

Re: Attacking on Source Port 0 (ZERO)

2012-10-14 Thread Nick Hilliard
On 14/10/2012 20:59, Shahab Vahabzadeh wrote: > But I see abnormal cpu usage (%99) in my BRAS's which are Cisco 7206 VXR. If you haven't already configured CoPP on your BRASs, you might want to look at deploying it. It won't solve this sort of problem, but it will probably help: > http://www.cis

Re: Attacking on Source Port 0 (ZERO)

2012-10-14 Thread Shahab Vahabzadeh
Hi there, It was TCP and I think it was not a DDoS attack because the traffic was not heavy. But I see abnormal cpu usage (%99) in my BRAS's which are Cisco 7206 VXR. I think it act like a warm or some attacks which cause high CPU load in some IOS. Thanks On Sun, Oct 14, 2012 at 5:13 PM, Dobbins,

Re: Attacking on Source Port 0 (ZERO)

2012-10-14 Thread Dobbins, Roland
On Oct 14, 2012, at 4:48 PM, Shahab Vahabzadeh wrote: > Does any body know what kind of attack can be come to port 0? If it's protocol 0, instead of port 0, it's likely a packet-flooding DDoS attack. If it's port 0, you may be incorrectly blocking non-initial fragments. Alternately, it could

Attacking on Source Port 0 (ZERO)

2012-10-14 Thread Shahab Vahabzadeh
Hi everybody, Does any body know what kind of attack can be come to port 0? I see such a logs in my routers which make high cpu loads: MYROUTERIP:0 *41.78.77.178:2816* MYROUTERIP:0 *217.160.5.153:2816* Thanks -- Regards, Shahab Vahabzadeh, Network Engineer and System Administrator Cell Phone: