Hi all,
We are seeing a situation with 7206VXR + 12.1(6) (Service Provider if
I'm correct) that show both the src & dest as the same interface (typically
the serial, but there are reported cases of the ethernet too), althought
the flow are coming from a different interface.
This appears to be happening in specific mail & DNS flooding/scanning
to sites on the other side of a serial interface from a remote site.
The interesting thing is that when I looked at the "sh ip cache flow" output,
I noticed that the same flow appears to have come from the fa0/0 going to
se5/4, but above or below the flow coming and going to the se5/4 interface.
The difference are the amount of packets reported for each flow.
Anybody else noticed something like this before?
These are on client acces routers.
Greetz`
-- ------------------------ Hendrik Visage hvisage@envisage.co.za -- cflowd mailing list cflowd@caida.org
This archive was generated by hypermail 2b29 : Tue Apr 10 2001 - 13:32:03 PDT