after Cisco IOS exploit patch
After I upgraded my IOS this morning I've seen 13,844 input errors on the port; when looking at the switch the router is connected to I see that a very similar number of multi-cast packets (13,423). Has anyone else seen this? Is this perhaps what the patch does (register exploit packets as input errors)? FastEthernet0/0 is up, line protocol is up Hardware is DEC21140A, address is 0002.1723.0800 (bia 0002.1723.0800) Internet address is 199.185.131.249/24 MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 106/255, rxload 118/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, 100BaseTX/FX ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/53/231 (size/max/drops/flushes); Total output drops: 733 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 46298000 bits/sec, 9642 packets/sec 5 minute output rate 41710000 bits/sec, 8891 packets/sec 163709405 packets input, 2006456215 bytes Received 11374 broadcasts, 0 runts, 0 giants, 2 throttles 13844 input errors, 0 CRC, 0 frame, 0 overrun, 13182 ignored 0 watchdog 0 input packets with dribble condition detected 157777703 packets output, 1121349334 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out FastEthernet8 is up Hardware is FastEthernet, address is 00e0.5202.4613 (bia 00e0.5202.4613) Configured speed 100Mbit, actual 100Mbit, configured duplex fdx, actual fdx Member of L2 VLAN ID 1, port is untagged, port state is FORWARDING STP configured to OFF, priority is high, flow control enabled mirror disabled, monitor disabled Not member of any active trunks Not member of any configured trunks No port name 5 minute input rate: 43045336 bits/sec, 8985 packets/sec, 44.47% utilization 5 minute output rate: 46621104 bits/sec, 9711 packets/sec, 48.16% utilization 689714869 packets input, 3817420687 bytes, 0 no buffer Received 4493 broadcasts, 0 runts, 0 giants 5 input errors, 5 CRC, 0 frame, 0 ignored 13423 multicast 736196013 packets output, 1836390208 bytes, 0 underruns 0 output errors, 0 collisions ________________________ saxon jones network infrastructure admin interbaun communications suite 200 18404 stony plain road edmonton, ab T5S 2M8 <mailto:netadmin@interbaun.net> mailto:netadmin@interbaun.net <http://www.interbaun.com/> http://www.interbaun.com/ (780) 447-8276
On Fri, 2003-07-18 at 14:49, Saxon Jones wrote:
After I upgraded my IOS this morning I've seen 13,844 input errors on the port; when looking at the switch the router is connected to I see that a very similar number of multi-cast packets (13,423).
Has anyone else seen this? Is this perhaps what the patch does (register exploit packets as input errors)?
FWIW, we re-tested again to check this.. We put the router under a heavy load of exploited packets and did not see this.. We tested all 4 protocols.
________________________ saxon jones network infrastructure admin interbaun communications suite 200 18404 stony plain road edmonton, ab T5S 2M8 mailto:netadmin@interbaun.net http://www.interbaun.com/ (780) 447-8276
-- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz@corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]
participants (2)
-
Jason Frisvold
-
Saxon Jones