Re: Using crypto auth for detecting corrupted IGP packets?

who are using cryptographic authentication mechanisms only for integrity may want to look at http://www.ietf.org/id/draft-jakma-ospf-integrity-00.txt Cheers, Manav On Fri, Oct 1, 2010 at 9:04 AM, Manav Bhatia wrote: > Hi, > > I believe, based on what i have heard,  that some operator

clear forwarding route

Hi, I would like understand the circumstances under which an operator may want to clear all (or a subset of) the routes programmed in the forwarding table (FIB). I believe the command to do this on Cisco is clear forwarding {ipv4 | ipv6} route {* | prefix} [vrf vrf-name] module {slot| all} I as

OSPFv3 Authentication

Hi, I am doing a survey and was interested in knowing if network operators are using OSPFv3 with authentication [RFC 4552] turned on? I know that most providers turn on authentication with OSPFv2, but given that OSPFv3 needs IPsec integration and can thus get little cumbersome to configure, wanted

Re: OSPFv3 Authentication

special license which can be expensive. o Unsure of how well is the IPsec implemented on the boxes Cheers, Manav On Tue, Sep 28, 2010 at 5:33 AM, Manav Bhatia wrote: > Hi, > > I am doing a survey and was interested in knowing if network operators > are using OSPFv3 with authenticati

Using crypto auth for detecting corrupted IGP packets?

Hi, I believe, based on what i have heard, that some operators turn on cryptographic authentication because the internet checksum that OSPF, etc use for packet sanity is quite weak and offers trifle little protection against lot of known errors like: - re-ordering of 2-byte aligned words - vario

Re: Using crypto auth for detecting corrupted IGP packets?

> > I really wish there was a good way to (generically) keep a 4-6 hour buffer of > all control-plane traffic on devices. While you can do that with some, the > forensic value is immense when you have a problem. > Buffering for 4-6 hours worth of control traffic is HUGE! What about mirroring you

Re: Using crypto auth for detecting corrupted IGP packets?

> >> Buffering for 4-6 hours worth of control traffic is HUGE! > > If 4-6 hours of *control-plane* traffic on a given device is 'HUGE!', for > some reasonable modern value of 'HUGE!', then there's definitely a problem on > the network in question. With BFD alone (assuming 20 sessions, 50ms timer