Attack on UDP 101

Dear Stefan,
I have an 7206VXR Router with this design:

int gig 0/1: directly connected to 3750 switch (uplink to internet)
int gig 0/2: vlan termination from PSTN centers
int virtual-template1: xdsl users

Its about 4 days that I see near 300Mpbs outbound traffic in int gig0/1
that there is no such a traffic in none of routers interface, but the same
traffic is seen in 3750 peer interface.
I try to run monitor session on 3750 and monitor port traffic which I see
that packet is generating from a user and its in a loop between 3750 and
7206.
When I disconnect that user, I see that that packet is in loop again,
because of that I am sure its making a loop but I do not know the reseaon
is that packets or not.

Thanks

A packet doesn't make a loop. A device would create that. So if you
are sending the packet out, but something else is sending it back, I'd
go take a look at where that's occurring on your devices.

If you disconnected the user in question, then what else has either
taken over that address, or what device is mistakenly sending things back?

Something on your network is making a decision about it, you just need
to figure out why. :wink:

Scott

Dear Stefan,
I have an 7206VXR Router with this design:

int gig 0/1: directly connected to 3750 switch (uplink to internet)
int gig 0/2: vlan termination from PSTN centers
int virtual-template1: xdsl users

Its about 4 days that I see near 300Mpbs outbound traffic in int gig0/1
that there is no such a traffic in none of routers interface, but the same
traffic is seen in 3750 peer interface.
I try to run monitor session on 3750 and monitor port traffic which I see
that packet is generating from a user and its in a loop between 3750 and
7206.

I suspect that the 7206 and 3750 both thing the other guy has
default... and with no more specific to follow the packet just
pingpongs between the 2 devices. I would also suspect you see this for
more than one destination :frowning:

picking just one entry (last entry I see) from route-views.routeviews.org:
BGP routing table entry for 76.164.192.0/19, version 708055091
Paths: (35 available, best #31, table Default-IP-Routing-Table)
...
4436 6939 53340 36114
    69.31.111.244 from 69.31.111.244 (69.31.111.244)
      Origin IGP, metric 0, localpref 100, valid, external
      Community: 4436:21216

all of 36114(versaweb) traffic would seem to head through
53340(vegasnap) on the way home, so... maybe something else is going
on like you didn't accept transit routes (or send them or something
else) from your transit? hard to say with as little info as we see
here, but :slight_smile:

Can hardware problem make something happen?

Can hardware problem make something happen?

a CEF corruption could, but really... I'd start with on both devices:
  show ip route <ip>

and see if perhaps they both point to each other... then resolve that problem.