On Mon, 2008-07-14 at 18:07 +0200, Iddo wrote: > We are running a 6500/sup720-3BXL wit 12.2.18SXF13 > A DoS attack 300,000pps was sent to an IP address which directly > connected, but not in use by a machine. > The arp entry for the target IP address is "incomplete". > > This caused interrupt based CPU to 90+ %, which in turn caused > OSPF/BGP etc to timeout. > > I can reproduce the results with a packetgenerator. > > Can anyone recommend a solution for this?
The problem would be because the 6500 tries to determine the L2 address of the destination host via ARP. There are a couple of solutions. As a simple solution, you can rate limit packets punted to the RP for ARP resolution. This will generally rate limit ARP, and should be used carefully since you could be DoS'ed in another way: Starving your ability to ARP. The command is "mls rate-limit unicast cef glean <PPS>". Since the host doesn't exists, you could also blackhole just this host, e.g. "ip route 10.1.2.3 255.255.255.255 Null0" for the host 10.1.2.3. For the 6500 this would just throw traffic to that host away, and not disturb your RP. Of course there could be a point in blocking this closer to the source, but that might not be easy. Regards, Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
