Ron Buchalski <rbuchals(a)hotmail.com> wrote:
> Clifton,
I wrote that stuff. Clifton wrote the question about
'no ip directed-broadcast' - I think maybe he's not
on nanog-post, which is why the original hasn't
appeared (yet?).
> Have you verified that operation on the router?
I used 'debug ip icmp' both with and without 'ip route-cache
same-interface', and saw significantly fewer redirects when it
was on.
> I believe that if the
> stupid or malicious host continued to send packets to the router when they
> are really destined for another host (or router) on the subnet, that the
> router would continue to send ICMP redirects back to the sending host, and
> wouldn't cache this response for future packets, even with 'ip route-cache
> same-interface' enabled. The router should only populate it's forwarding
> table with next hop information for real data flows, and an ICMP redirect
> (which is telling the host that this (through the router) isn't the correct
> path for a specific data flow) shouldn't be cached. I haven't verified
> this, though...
But there is a real data flow (in that the router will actually switch
the data packets back out of the same interface, as well as sending
redirects). The IOS docs for 11.1 through 12.0 have this to say on the
subject...
-- quote --
ip redirects
To enable the sending of redirect messages if the Cisco IOS software
is forced to resend a packet through the same interface on which it
was received, use the ip redirects interface configuration command. To
disable the sending of redirect messages, use the no form of this
command.
ip route-cache
To control the use of a high-speed switching cache for IP routing as
well as the use of autonomous switching, use the ip route-cache
interface configuration command. To disable fast switching and
autonomous switching, use the no form of this command.
ip route-cache [cbus]
no ip route-cache [cbus] ip route-cache same-interface
no ip route-cache same-interface ip route-cache sse
no ip route-cache sse ip route-cache [optimum | flow]
no ip route-cache [optimum | flow] ip route-cache distributed
no ip route-cache distributed
Syntax Description
[...]
same-interface Enables fast switching packets back out the interface
on which they arrived.
[...]
You can enable IP fast switching when the input and output interfaces
are the same interface, using the ip route-cache same-interface
command. This normally is not recommended, though it is useful when
you have partially meshed media, such as Frame Relay. You could use
this feature on other interfaces, although it is not recommended
because it would interfere with redirection.
-- unquote --
Although there is an 'ip route-cache cef' command in 12.0, it
doesn't appear to have any options, so maybe redirects just
work under CEF (good news for people who use it on their border
routers maybe).
M.
