On Sat, 25 Jan 2003, Neil J. McRae wrote:

...

Anybody here on list using Extreme products (Summit/Alpine/Blackdiamond)? They sure don't like this traffic one bit. It causes them to not only drop traffic, but spew out every available error message under the sun...

Extreme are apparently assembling an "advisory TAC" on this, from our point of view, since we use the devices to do l3 aggregation (for colo and such) we've used an ACL to try and combat the offending traffic, but its not doing much good.....

Do you have MCAST enabled on these switches? I'd guess this is what is causing issues on the extreme boxes.

I think the architecture is flow-based, ie, the first packet of each flow hits the CPU. This is probably causing the high CPU utilization. The flow would still hit the CPU even with a ACL and then probably be written to the ASIC with a null location. andy -- PGP Key Available at http://www.tigerteam.net/andy/pgp

...

Anybody here on list using Extreme products (Summit/ Alpine/ Blackdiamond)? They sure don't like this traffic one bit. It causes them to not only drop traffic, but spew out every available error message under the sun...

We use extremes in our core and it did not log much other than CPU issues:

01/25/2003 02:20.23 <INFO:SYST> task tNetTask cpu utilization is 88% PC: ...

All of the ExtremeNetworks devices I've laid my hands on are in strict L2 mode and their management interfaces are either on private networks or behind firewalls. If you are relying on their ACL's to protect your telnet and snmp access, but are otherwise allowing their management interfaces to hear traffic from the whole Internet, then you should turn in your badge and go back to bagging groceries or whatever it is you used to do. (Same goes for any management interface on any L1-L2-L3-L4 product made by any vendor, so I'm not intending to pick on Extreme individually here.) -- Paul Vixie

...

... If you are relying on their ACL's to protect your telnet and snmp access, but are otherwise allowing their management interfaces to hear traffic from the whole Internet, then you should turn in your badge and go back to bagging groceries or whatever it is you used to do.

Some would argue this should apply to those exposing MSSQL to the outside world such that it could even receive malicious port 1434 packets...

in fairness to microsoft, there have been worms based on apache and bind and popper and fingerd (buffer overruns) and even sendmail (wizard password) so the wide scale code review one gets from open source software engineering is only a marginal solution to monocultural weakness vectors. -- Paul Vixie