IOS going cuckoos under load???

From: Hendrik Visage (hvisage@envisage.co.za)
Date: Tue Apr 10 2001 - 13:25:41 PDT

  • Next message: johnh@cryc.com: "Problem: 6509 w/ MSFC"

    Hi all,

     We are seeing a situation with 7206VXR + 12.1(6) (Service Provider if
    I'm correct) that show both the src & dest as the same interface (typically
    the serial, but there are reported cases of the ethernet too), althought
    the flow are coming from a different interface.

     This appears to be happening in specific mail & DNS flooding/scanning
    to sites on the other side of a serial interface from a remote site.

     The interesting thing is that when I looked at the "sh ip cache flow" output,
    I noticed that the same flow appears to have come from the fa0/0 going to
    se5/4, but above or below the flow coming and going to the se5/4 interface.
    The difference are the amount of packets reported for each flow.

     Anybody else noticed something like this before?

     These are on client acces routers.

    Greetz`

    -- 
    ------------------------
    Hendrik Visage
    hvisage@envisage.co.za
    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Tue Apr 10 2001 - 13:32:03 PDT