Hi all, Today I had to track down a Windows PC with a 169.254.x IP that was sending some annoying directed broadcast packets around my network.
Yes, uRPF would take care of this, and that's what I've used to drop any such traffic in the future. I was using NetFlow and CEF to trace the source, hop by hop, but I eventually came to a DMVPN hub router where this method came unstuck. The NetFlow cache reveals the interface the packet was received on, but it's a multipoint GRE tunnel interface with a whole bunch of adjacent routers, each with their own stub networks. I gave in and scripted a "sh ip cache flow | i 169.254" command to run on each of the downstream spoke routers when a broadcast packet was seen upstream, and this worked, but I was wondering if there was a better way. So, is there a better way? cheers, Dale _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
