- NANOG - lists.nanog.org

RE: cef/process switching problem
by Austad, Jay 09 Sep '03

09 Sep '03

It's 12.2 code. show ip int e0 shows that CEF is enabled on the interface. Supposedly 12.2's CEF also handles policy routing (which is not being used on this router). > -----Original Message----- > From: Jason Frisvold [mailto:friz@corp.ptd.net] > Sent: Tuesday, September 09, 2003 10:24 AM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: Re: cef/process switching problem > > > Not sure on the MC3810 (never used one), but I know that many of the > other Cisco routers didn't do CEF on ethernet until later revisions of > code... There are other factors that kick it out of CEF as well.. I > believe ACL's and Route Maps are 2 of them.. > > On Tue, 2003-09-09 at 11:07, Austad, Jay wrote: > > I've got a cisco MC3810 with a bunch of DSL customers on it. CEF is > > enabled, but when I do a show int stat, I see that almost > 100% of the > > outbound packets on the ethernet interface are process > switched, and not > > being matched in the route cache. The Input looks just > fine, and the other > > interfaces are borderline (usually 50% hit rate on the > cache or a little > > less). > > > > CPU is sitting pretty high on this box during the day, and > I have strong > > suspicions that this is why. :) > > > > I can't seem to find any info on why this would be > happening or how to > > figure out what's going on. Anyone have any suggestions? > > > > -jay > -- > --------------------------- > Jason H. Frisvold > Backbone Engineering Supervisor > Penteledata Engineering > friz(a)corp.ptd.net > RedHat Engineer - RHCE # 807302349405893 > Cisco Certified - CCNA # CSCO10151622 > MySQL Core Certified - ID# 205982910 > --------------------------- > "Imagination is more important than knowledge. > Knowledge is limited. Imagination encircles > the world." > -- Albert Einstein [1879-1955] >

2 1

cef/process switching problem
by Austad, Jay 09 Sep '03

09 Sep '03

I've got a cisco MC3810 with a bunch of DSL customers on it. CEF is enabled, but when I do a show int stat, I see that almost 100% of the outbound packets on the ethernet interface are process switched, and not being matched in the route cache. The Input looks just fine, and the other interfaces are borderline (usually 50% hit rate on the cache or a little less). CPU is sitting pretty high on this box during the day, and I have strong suspicions that this is why. :) I can't seem to find any info on why this would be happening or how to figure out what's going on. Anyone have any suggestions? -jay

2 1

Proxy posting: Worldcom DS3 hub down ?
by Jan Czmok 09 Sep '03

09 Sep '03

David has no posting rights on nanog, so i proxing his request: A Montreal Worldcom DS3 hub is reported down disrupting connectivity. Can this be confirmed? Is there any estimated time for completion/restoration? Many thanks. -- Best wishes, David David Rose Call 860 228 8912 Cell 860 377 8512 -- Jan Czmok, Network Engineering & Support, Global Access Telecomm, Inc. Ph.: +49 69 299896-35 - fax: +49 69 299896-40 - sip:13129*522@inoc-dba.pch.net

1 0

Re: Fun new policy at AOL
by Michael.Dillon＠radianz.com 09 Sep '03

09 Sep '03

>How does this sound for a new mail distribution network. >Customers can only send mail through their direct provider >ISPs can only send mail to their customers and their upstream provider. Sounds like NIMTP. See Google for more... --Michael Dillon

1 0

Cogentco/PSI BGP Admin around ?
by Jan Czmok 09 Sep '03

09 Sep '03

Subject says all :-) i am in urgent need of a bgp engineer from cogentco. their noc isn't helpful at all, no answer (except a ticket #) --jan -- Jan Czmok, Network Engineering & Support, Global Access Telecomm, Inc. Ph.: +49 69 299896-35 - fax: +49 69 299896-40 - sip:13129*522@inoc-dba.pch.net

1 0

Cisco ONS 15454 Password Recovery
by Matthew Crocker 09 Sep '03

09 Sep '03

Dear List, I know this isn't the correct forum and for that I apologize. I have been searching Ciscos website for the past 5 hours with no luck. I need to know how I can gain access to a Cisco ONS 15454 with TCC+ running 2.2.1 software rev. If anyone knows how to accomplish this please e-mail me off list. I have physical access to the unit, I can access it via Telnet, TL1 or CTC (web). The Node isn't in service now so I can power cycle it if needed. I need to get this into service tomorrow and I have exhausted all of my ideas on where to look for the information. Ideally I would like to reset the CISCO15 password to the default ('') without deleting the database. Thanks -Matt

1 0

What were we saying about edge filtering?
by Matthew Sullivan 09 Sep '03

09 Sep '03

Hi All, More whining and bitching from me ... sorry... So who thinks allowing anyone to route to or from IANA Reserved blocks (Bogons) is acceptable? A few captured packets.... 15:42:41.434384 1.6.145.24.1116 > 203.101.254.254.53: S 2056192000:2056192000(0) win 16384 15:42:41.570812 1.6.145.161.1043 > 203.101.254.254.53: S 773455872:773455872(0) win 16384 15:42:41.678862 1.6.147.198.1505 > 203.101.254.254.53: S 424280064:424280064(0) win 16384 15:42:41.985075 1.6.148.115.1448 > 203.101.254.254.53: S 1675624448:1675624448(0) win 16384 15:42:42.045121 1.6.148.202.1467 > 203.101.254.254.53: S 2072117248:2072117248(0) win 16384 15:42:42.528080 1.6.151.121.1180 > 203.101.254.254.53: S 1363410944:1363410944(0) win 16384 15:42:42.851633 1.6.153.101.1904 > 203.101.254.254.53: S 786563072:786563072(0) win 16384 15:42:42.908956 1.6.153.158.1712 > 203.101.254.254.53: S 1205272576:1205272576(0) win 16384 15:42:43.564536 1.6.157.75.1864 > 203.101.254.254.53: S 1150615552:1150615552(0) win 16384 15:42:43.653790 1.6.157.220.1882 > 203.101.254.254.53: S 209584128:209584128(0) win 16384 15:42:43.900861 1.6.159.103.1172 > 203.101.254.254.53: S 1935015936:1935015936(0) win 16384 15:42:44.247869 1.6.161.53.1045 > 203.101.254.254.53: S 1374552064:1374552064(0) win 16384 15:42:44.247936 1.6.161.140.1877 > 203.101.254.254.53: S 1761083392:1761083392(0) win 16384 15:42:44.388279 1.6.162.58.1230 > 203.101.254.254.53: S 1534263296:1534263296(0) win 16384 15:42:44.583169 1.6.163.23.1584 > 203.101.254.254.53: S 467271680:467271680(0) win 16384 15:42:44.653624 1.6.163.168.1091 > 203.101.254.254.53: S 1094844416:1094844416(0) win 16384 15:42:44.960670 1.6.166.33.1953 > 203.101.254.254.53: S 517210112:517210112(0) win 16384 15:42:45.323007 1.6.167.182.1541 > 203.101.254.254.53: S 417857536:417857536(0) win 16384 15:42:45.558600 1.6.168.235.1603 > 203.101.254.254.53: S 1652490240:1652490240(0) win 16384 15:42:45.588731 1.6.169.36.1581 > 203.101.254.254.53: S 1524498432:1524498432(0) win 16384 15:42:45.618207 1.6.170.39.1591 > 203.101.254.254.53: S 271319040:271319040(0) win 16384 15:42:47.164426 1.6.178.177.1159 > 203.101.254.254.53: S 879689728:879689728(0) win 16384 15:42:47.379603 1.6.179.231.1331 > 203.101.254.254.53: S 1859256320:1859256320(0) win 16384 15:42:47.979871 1.6.183.72.1516 > 203.101.254.254.53: S 1277362176:1277362176(0) win 16384 15:42:48.249871 1.6.184.215.1945 > 203.101.254.254.53: S 718929920:718929920(0) win 16384 15:42:48.581342 1.6.186.166.1478 > 203.101.254.254.53: S 889782272:889782272(0) win 16384 15:42:48.638018 1.6.187.54.1372 > 203.101.254.254.53: S 1532952576:1532952576(0) win 16384 15:42:48.803879 1.6.188.47.1253 > 203.101.254.254.53: S 1614348288:1614348288(0) win 16384 15:42:48.910837 1.6.188.191.1872 > 203.101.254.254.53: S 164429824:164429824(0) win 16384 15:42:49.014086 1.6.189.22.1078 > 203.101.254.254.53: S 1580924928:1580924928(0) win 16384 And a few more.... 13:31:16.215267 255.205.43.12.1146 > 203.101.254.254.53: S 1909522432:1909522432(0) win 16384 13:31:16.225790 254.255.110.156.1934 > 203.101.254.254.53: S 843513856:843513856(0) win 16384 13:31:16.255373 255.205.9.178.1040 > 203.101.254.254.53: S 1741881344:1741881344(0) win 16384 13:31:16.297785 255.64.58.64.1759 > 203.101.254.254.53: S 832634880:832634880(0) win 16384 13:31:16.365988 255.64.58.47.1057 > 203.101.254.254.53: S 1301217280:1301217280(0) win 16384 13:31:16.375685 254.255.111.56.1351 > 203.101.254.254.53: S 2103771136:2103771136(0) win 16384 13:31:16.397829 254.255.110.157.1513 > 203.101.254.254.53: S 1743912960:1743912960(0) win 16384 13:31:16.562945 254.255.111.57.1137 > 203.101.254.254.53: S 1048379392:1048379392(0) win 16384 13:31:16.586507 255.64.58.106.1017 > 203.101.254.254.53: S 1919811584:1919811584(0) win 16384 13:31:16.607479 254.255.110.158.1400 > 203.101.254.254.53: S 1749942272:1749942272(0) win 16384 13:31:16.633489 255.64.58.118.1783 > 203.101.254.254.53: S 1790640128:1790640128(0) win 16384 13:31:16.669888 255.64.58.130.1871 > 203.101.254.254.53: S 223608832:223608832(0) win 16384 13:31:16.727705 255.205.44.169.1309 > 203.101.254.254.53: S 1294270464:1294270464(0) win 16384 13:31:16.769538 255.205.11.113.1578 > 203.101.254.254.53: S 386662400:386662400(0) win 16384 13:31:16.804433 254.255.111.58.1724 > 203.101.254.254.53: S 1657602048:1657602048(0) win 16384 13:31:16.804552 255.64.58.195.1374 > 203.101.254.254.53: S 1183514624:1183514624(0) win 16384 13:31:16.838304 254.255.110.159.1749 > 203.101.254.254.53: S 2041905152:2041905152(0) win 16384 13:31:16.854785 255.205.45.24.1962 > 203.101.254.254.53: S 980942848:980942848(0) win 16384 13:31:16.891851 255.64.58.189.1145 > 203.101.254.254.53: S 1588723712:1588723712(0) win 16384 13:31:16.907291 255.205.45.101.1850 > 203.101.254.254.53: S 281804800:281804800(0) win 16384 13:31:16.926608 255.64.58.199.1491 > 203.101.254.254.53: S 396623872:396623872(0) win 16384 13:31:16.960441 255.64.58.240.1647 > 203.101.254.254.53: S 1321926656:1321926656(0) win 16384 13:31:17.041859 254.255.111.59.1760 > 203.101.254.254.53: S 1589116928:1589116928(0) win 16384 13:31:17.056862 254.255.110.160.1140 > 203.101.254.254.53: S 707133440:707133440(0) win 16384 13:31:17.080801 255.205.45.214.1924 > 203.101.254.254.53: S 1915224064:1915224064(0) win 16384 13:31:17.125443 255.64.59.0.1309 > 203.101.254.254.53: S 582287360:582287360(0) win 16384 13:31:17.228794 254.255.111.60.1733 > 203.101.254.254.53: S 1086128128:1086128128(0) win 16384 13:31:17.248735 255.205.13.20.1313 > 203.101.254.254.53: S 1997733888:1997733888(0) win 16384 13:31:17.272623 254.255.110.161.1478 > 203.101.254.254.53: S 2034368512:2034368512(0) win 16384 13:31:17.337051 255.205.46.189.1570 > 203.101.254.254.53: S 1085341696:1085341696(0) win 16384 13:31:17.380544 255.205.13.134.1182 > 203.101.254.254.53: S 1334706176:1334706176(0) win 16384 13:31:17.393981 255.64.59.108.1988 > 203.101.254.254.53: S 275841024:275841024(0) win 16384 13:31:17.394332 254.255.111.61.1225 > 203.101.254.254.53: S 1829044224:1829044224(0) win 16384 13:31:17.409783 254.255.110.162.1695 > 203.101.254.254.53: S 472383488:472383488(0) win 16384 13:31:17.419251 255.205.13.171.1933 > 203.101.254.254.53: S 1066336256:1066336256(0) win 16384 13:31:17.510895 254.255.111.62.1450 > 203.101.254.254.53: S 1052508160:1052508160(0) win 16384 13:31:17.535728 254.255.110.163.1492 > 203.101.254.254.53: S 289079296:289079296(0) win 16384 13:31:17.545043 255.205.47.123.1256 > 203.101.254.254.53: S 1559035904:1559035904(0) win 16384 13:31:17.680832 255.64.59.182.1939 > 203.101.254.254.53: S 930217984:930217984(0) win 16384 13:31:17.718981 254.255.111.63.1391 > 203.101.254.254.53: S 2029191168:2029191168(0) win 16384 13:31:17.739317 255.64.59.168.1043 > 203.101.254.254.53: S 1719926784:1719926784(0) win 16384 13:31:17.749319 254.255.110.164.1398 > 203.101.254.254.53: S 444006400:444006400(0) win 16384 13:31:17.820087 255.64.59.225.1438 > 203.101.254.254.53: S 186712064:186712064(0) win 16384 13:31:17.845466 255.64.59.232.1771 > 203.101.254.254.53: S 1787756544:1787756544(0) win 16384 13:31:17.849674 255.205.48.121.1409 > 203.101.254.254.53: S 1942159360:1942159360(0) win 16384 13:31:17.856734 254.255.111.64.1394 > 203.101.254.254.53: S 1471348736:1471348736(0) win 16384 13:31:17.883396 254.255.110.165.1367 > 203.101.254.254.53: S 611909632:611909632(0) win 16384 13:31:17.895921 255.205.48.160.1147 > 203.101.254.254.53: S 1586495488:1586495488(0) win 16384 13:31:17.913763 255.64.59.249.1026 > 203.101.254.254.53: S 708116480:708116480(0) win 16384 13:31:17.951460 255.205.15.147.1949 > 203.101.254.254.53: S 2000027648:2000027648(0) win 16384 13:31:17.989485 254.255.111.65.1467 > 203.101.254.254.53: S 81395712:81395712(0) win 16384 Is there any need to route bogons? Is there any reason why it cannot be filtered (I appreciate 224-239 is a different story)....? These packets were all originated on the other side of the Pacific to Telecom NZ. / Mat

14 17

dns.exe virus?
by Christopher J. Wolff 08 Sep '03

08 Sep '03

Greetings, After tracking down what I believed was an attempted DOS attack, it turns out that two Windows 2000 servers, fully updated, were spewing out hundreds of port 53 requests. Upon further investigation dns.exe was hogging 99% of the CPU. I haven't found any reference to this at CERT so I thought I would drop the occurrence into the nanog funnel to see what comes out. The attack started around 8AM MST. Thank you for your consideration. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

6 8

arin.net DNS problems
by Kai Schlichting 08 Sep '03

08 Sep '03

I had intermittent failures to resolve whois.arin.net today, and haven't bothered to investigate this until now: someone please forward this to an after-hours person at ARIN, hostmaster(a)arin.net will probably not be read for a while. Reason: BUCHU.arin.net. 3H IN A 192.100.59.110 arrowroot.arin.net. 3H IN A 198.133.199.110 are both not returning any A record for 'whois.arin.net' $ dig +norec @a.gtld-servers.net arin.net ns ;; ANSWER SECTION: arin.net. 2D IN NS l3.nstld.com. arin.net. 2D IN NS a3.nstld.com. arin.net. 2D IN NS c3.nstld.com. arin.net. 2D IN NS f3.nstld.com. arin.net. 2D IN NS g3.nstld.com. arin.net. 2D IN NS buchu.arin.net. arin.net. 2D IN NS arrowroot.arin.net. All *.nstld.com servers respond with: whois.arin.net. 3H IN A 192.149.252.43 The zone serials are consistent: ;; ANSWER SECTION: arin.net. 3H IN SOA arrowroot.arin.net. bind.arin.net. ( 2003061812 ; serial 3H ; refresh 10M ; retry 2W ; expiry 1H ) ; minimum However, buchu and arrowroot.arin.net BOTH answer very oddly when queried for an SOA: they are returning an A record for arin.net - not quite what was asked for! $ dig +norec @198.133.199.110 arin.net soa ; <<>> DiG 8.2 <<>> +norec @198.133.199.110 arin.net soa ; (1 server found) ;; res options: init defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1426 ;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 10, ADDITIONAL: 2 ;; QUERY SECTION: ;; arin.net, type = SOA, class = IN ;; ANSWER SECTION: arin.net. 3H IN A 192.149.252.17 ;; AUTHORITY SECTION: arin.net. 3H IN NS L3.NSTLD.COM. arin.net. 3H IN NS G3.NSTLD.COM. arin.net. 3H IN NS F3.NSTLD.COM. arin.net. 3H IN NS E3.NSTLD.COM. arin.net. 3H IN NS D3.NSTLD.COM. arin.net. 3H IN NS C3.NSTLD.COM. arin.net. 3H IN NS BUCHU.arin.net. arin.net. 3H IN NS B3.NSTLD.COM. arin.net. 3H IN NS arrowroot.arin.net. arin.net. 3H IN NS A3.NSTLD.COM. ;; ADDITIONAL SECTION: arrowroot.arin.net. 3H IN A 198.133.199.110 BUCHU.arin.net. 3H IN A 192.100.59.110 ;; Total query time: 17 msec ;; FROM: sonet.conti.nu to SERVER: 198.133.199.110 ;; WHEN: Mon Sep 8 18:34:11 2003 ;; MSG SIZE sent: 26 rcvd: 263 However, an 'any' query yields: $ dig +norec @198.133.199.110 arin.net any ; <<>> DiG 8.2 <<>> +norec @198.133.199.110 arin.net any ; (1 server found) ;; res options: init defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55882 ;; flags: qr aa; QUERY: 1, ANSWER: 16, AUTHORITY: 0, ADDITIONAL: 4 ;; QUERY SECTION: ;; arin.net, type = ANY, class = IN ;; ANSWER SECTION: arin.net. 3H IN SOA arrowroot.arin.net. bind.arin.net. ( 2003061812 ; serial 3H ; refresh 10M ; retry 2W ; expiry 1H ) ; minimum arin.net. 3H IN A 192.149.252.17 arin.net. 3H IN MX 10 smtp2.arin.net. arin.net. 3H IN MX 20 smtp1.arin.net. arin.net. 3H IN NS L3.NSTLD.COM. arin.net. 3H IN NS G3.NSTLD.COM. arin.net. 3H IN NS F3.NSTLD.COM. arin.net. 3H IN NS E3.NSTLD.COM. arin.net. 3H IN NS D3.NSTLD.COM. arin.net. 3H IN MX 40 cumin.apnic.net. arin.net. 3H IN NS C3.NSTLD.COM. arin.net. 3H IN NS BUCHU.arin.net. arin.net. 3H IN NS B3.NSTLD.COM. arin.net. 3H IN MX 30 aso.icann.org. arin.net. 3H IN NS arrowroot.arin.net. arin.net. 3H IN NS A3.NSTLD.COM. ;; ADDITIONAL SECTION: smtp2.arin.net. 3H IN A 192.149.252.32 smtp1.arin.net. 3H IN A 192.149.252.33 arrowroot.arin.net. 3H IN A 198.133.199.110 BUCHU.arin.net. 3H IN A 192.100.59.110 ;; Total query time: 117 msec ;; FROM: sonet.conti.nu to SERVER: 198.133.199.110 ;; WHEN: Mon Sep 8 18:36:01 2003 ;; MSG SIZE sent: 26 rcvd: 437 The *.nstld.com servers are answering to these queries in normal fashion. bye,Kai -- "Just say No" to Spam Kai Schlichting New York, Palo Alto, You name it Sophisticated Technical Peon Kai's SpamShield <tm> is FREE! http://www.SpamShield.org | | LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxes WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMath

1 0

Re: Cable & Wireless, Verio and/or Level 3 port blocking?
by Jared Mauch 08 Sep '03

08 Sep '03

On Mon, Sep 08, 2003 at 12:32:14PM -0700, Tom (UnitedLayer) wrote: > On Mon, 8 Sep 2003, Jared Mauch wrote: > > NTT/Verio is performing no network-wide port blocking > > of such services. > > Last time I asked, they were filtering to some degree. > I don't recall where they were filtering however. I know that there were some filters deployed initally but they were removed. Any filters that remain are one-off filters on individual customer connections. If you are a NTT/VERIO customer (is that better? ;-) ) and are experiencing problems you should obviously contact your relevant support teams. - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0