- NZNOG - lists.nznog.org

ICMP broadcast amplifier list (fwd)
by Alan Brown 21 Aug '00

21 Aug '00

For those not on Bugtraq. ---------- Forwarded message ---------- Date: Mon, 21 Aug 2000 18:40:39 -0700 From: Troy Davis <troy(a)NACK.NET> To: BUGTRAQ(a)SECURITYFOCUS.COM Subject: ICMP broadcast amplifier list netscan.org has rechecked all routed /24s for ICMP directed broadcasts (smurf amplification) and made public the complete list of misconfigured networks. The probes ran from 8/18-8/21. The results are queryable and downloadable at http://netscan.org Cheers, Troy --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

None
by None 17 Aug '00

17 Aug '00

JAA25389 for <nznog(a)list.waikato.ac.nz>; Fri, 18 Aug 2000 09:55:31 +1200 Received: from localhost [127.0.0.1]=20 by uber.samizdat.co.nz with esmtp (Exim 3.12 #1 (Debian)) id 13PXd8-0007OO-00; Fri, 18 Aug 2000 09:55:18 +1200 Date: Fri, 18 Aug 2000 09:55:18 +1200 (NZST) From: James Tyson <james(a)samizdat.co.nz> Sender: eugene(a)uber.samizdat.co.nz To: David Zanetti <dave2(a)earthling.net> cc: nznog(a)list.waikato.ac.nz Subject: Re: Bizzareness and Oddity with IOS In-Reply-To: <Pine.LNX.4.10.10008180939580.13987-100000(a)wakko.wetstring.net= > Message-ID: <Pine.LNX.4.21.0008180953350.28229-100000(a)uber.samizdat.co.nz> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=3DUS-ASCII > Hmmm.. very odd, 12.0(4)T with IP/FW leaked memory like there was no > tomorrow on our 3640 :) 12.0(7)T with the same features doesn't leak > memory (that I've noticed) and doesn't drop static routes either.. >=20 > Although they are different hardware platforms, so perhaps that'll make > the difference. I will obtain said image and try that :) We have found pretty much every IOS 12 release up until 12.0([10..11])S has been either unstable, leaked memory, or had some bug with one of the interface types we are running. That's on our 7500's though. Our 7200 VXR is running 11S and is as happy as larry, and has been for some time. James Tyson --- Samizdat New Media Solutions =20 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Weird BGP community stuff
by James Tyson 17 Aug '00

17 Aug '00

We have a router in Christchurch that seems to be sending community attributes to an EBGP peer, even though the neighbor statements dont contain the send-community argument. Does anyone know whats causing it? The router is running version 12.0(7)S1 on a 7500 series chasis. Also, on a somewhat related note, all domestic routes learned over WIX are being tagged with the community 9325:100, which is all cool. Our wix router does this: IPNWN1-B1#sh ip bgp 202.10.80.0 BGP routing table entry for 202.10.80.0/20, version 457621 Paths: (1 available, best #1, table Default-IP-Routing-Table) Advertised to non peer-group peers: 202.27.158.248 202.27.176.3 202.27.176.6 202.27.176.7 202.27.176.12 203.96.111.254 9718 202.7.0.78 from 202.7.0.78 (202.10.65.24) Origin IGP, metric 0, localpref 100, valid, external, best Community: 9325:100 The christchurch router says this: IPNCH1-B6#sh ip bgp 202.10.80.0 BGP routing table entry for 202.10.80.0/20, version 82178 Paths: (1 available, best #1) Advertised to non peer-group peers: 202.36.174.82 9718 202.7.0.78 (metric 179712) from 202.27.176.4 (202.27.185.135) Origin IGP, metric 0, localpref 100, valid, internal, best Community: 611123300 ^^^^^^^^^ - what is this?!?!? shouldnt it be 9325:100?? Any ideas anyone has would be helpful. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Weird BGP community stuff
by Ben Martel 17 Aug '00

17 Aug '00

James, Your 611123300 wierdo is actually just another way of representing 9325:100. It is really two sixteen bit values added together eg. 9325*65536 = 611123200 + 100 = 611123300 ( your answer) To change this representation you need to enter the IOS command: ip bgp-community new-format Cheers Ben > -----Original Message----- > From: James Tyson [mailto:james(a)samizdat.co.nz] > Sent: Friday, 18 August 2000 4:18 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: Weird BGP community stuff > > > > We have a router in Christchurch that seems to be sending > community > attributes to an EBGP peer, even though the neighbor > statements dont > contain the send-community argument. Does anyone know whats > causing it? > > The router is running version 12.0(7)S1 on a 7500 series chasis. > > Also, on a somewhat related note, all domestic routes learned > over WIX are > being tagged with the community 9325:100, which is all cool. Our wix > router does this: > > IPNWN1-B1#sh ip bgp 202.10.80.0 > BGP routing table entry for 202.10.80.0/20, version 457621 > Paths: (1 available, best #1, table Default-IP-Routing-Table) > Advertised to non peer-group peers: > 202.27.158.248 202.27.176.3 202.27.176.6 202.27.176.7 202.27.176.12 > 203.96.111.254 > 9718 > 202.7.0.78 from 202.7.0.78 (202.10.65.24) > Origin IGP, metric 0, localpref 100, valid, external, best > Community: 9325:100 > > The christchurch router says this: > > IPNCH1-B6#sh ip bgp 202.10.80.0 > BGP routing table entry for 202.10.80.0/20, version 82178 > Paths: (1 available, best #1) > Advertised to non peer-group peers: > 202.36.174.82 > 9718 > 202.7.0.78 (metric 179712) from 202.27.176.4 (202.27.185.135) > Origin IGP, metric 0, localpref 100, valid, internal, best > Community: 611123300 > ^^^^^^^^^ - what is this?!?!? shouldnt it be > 9325:100?? > > Any ideas anyone has would be helpful. > > James Tyson --- > Samizdat New Media Solutions > > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Bizzareness and Oddity with IOS
by Donald Neal 17 Aug '00

17 Aug '00

>>> "Sid Jones" <sjones(a)netlink.net.nz> 18/August/2000 11:39am >>> >Well I'm going to ask... why doesn't it just work? For a full explanation, see http://www.ubersoft.net/d/20000804.html . - Donald Neal :{)* --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Bizzareness and Oddity with IOS
by Scott, Arron 17 Aug '00

17 Aug '00

Not particularly odd to me, the 12.0T stream has various "new tchnologies" and "your milage may vary". Past VERY INTENSE relationships I have had with a number of 12.0T releases indicated that various hardware platforms behave very differently with each minor-release, and the activation of one feature or another also directly affects the behaviour. The 12.1 stream includes all the features of 12.0T, and is stabilising out well, you may want to look at trialling a release in there soon, if 12.04T gives you no luck. Arron Scott Systems Engineer Cisco Systems -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of David Zanetti Sent: Thursday, 17 August 2000 14:46 To: nznog(a)list.waikato.ac.nz Subject: Re: Bizzareness and Oddity with IOS On Thu, 17 Aug 2000, Russell Sharpe wrote: > Based on your description of required features ie BGP on a firewall > feature set, you will need the following: > > c7200-ios-mz.12.0-4.T (32/16) <<...>> S72CH-12.0.4T or S72CH-12.0.4T=, > which is IP/Firewall. Hmmm.. very odd, 12.0(4)T with IP/FW leaked memory like there was no tomorrow on our 3640 :) 12.0(7)T with the same features doesn't leak memory (that I've noticed) and doesn't drop static routes either.. Although they are different hardware platforms, so perhaps that'll make the difference. I will obtain said image and try that :) -- David Zanetti <dave2(a)earthling.net> | Crowd: "Someone else, someone else!" Moderator, nz.politics.announce | Homer: "I'm someone else!" #include <geek/unix.h> | -- The Simpsons --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: Bizzareness and Oddity with IOS
by Donald Neal 17 Aug '00

17 Aug '00

James Tyson wrote: > Hmmm.. very odd, 12.0(4)T with IP/FW leaked memory like there was no > tomorrow on our 3640 :) 12.0(7)T with the same features doesn't leak > memory (that I've noticed) and doesn't drop static routes either.. > > Although they are different hardware platforms, so perhaps that'll make > the difference. I will obtain said image and try that :) We have found pretty much every IOS 12 release up until 12.0([10..11])S has been either unstable, leaked memory, or had some bug with one of the interface types we are running. That's on our 7500's though. Our 7200 VXR is running 11S and is as happy as larry, and has been for some time. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

BOUNCE nznog@list.waikato.ac.nz: Admin request of type/\buns\w*b/i at line 9 -Forwarded
by Donald Neal 17 Aug '00

17 Aug '00

1 0

Bizzareness and Oddity with IOS
by David Zanetti 17 Aug '00

17 Aug '00

Have a Cisco 7206 (not the newer VXR model, the older one) and attempted last night to upgrade IOS on it from 11.2(3) to 12.0(7)T. Seemed to run okay (nothing on boot jumped out and said "broken") and pinged various bits of the network, with no problems. Left and went home :) Got to work this morning to discover "Internet broken". (Eventually) noticed that the 7206 had dropped two static routes, one of which was the default route. Hmmm.. Add them back, and a few minutes later they disappear again. Hmmmm.. Perhaps it's something odd comming from the BGP sessions with the WIX route server? Drop BGP, it still forgets the static routes after a few minutes. At this point we decided to back out of the IOS upgrade, and rebooted with 11.2(3), which has been running fine since. We do have a 3640 with the same feature set/revision, and it doesn't exhibit this problem. Suggestions? Give up on 12.0(7)T and pick a later release? Give up on the 12.0 tree altogether? Give up on IOS and Cisco altogether? :)) -- David Zanetti <dave2(a)earthling.net> | Crowd: "Someone else, someone else!" Moderator, nz.politics.announce | Homer: "I'm someone else!" #include <geek/unix.h> | -- The Simpsons --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

WIX Route Reflectors
by James Tyson 17 Aug '00

17 Aug '00

Just so that everyone knows; I have disabled Xtra's peering sessions with the WIX route reflectors and am falling back to direct peering arrangements with other ISP's and networks. If you need to ask why, then take a look at some of the AS-path's that thing is propagating. If you do not have a direct peering arrangement with Xtra over the WIX then I suggest that you mail me at james.tyson(a)team.xtra.co.nz, and do it fast, because I am leaving next friday. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3