Re: [nsp] Unknown packets

From: Jonathan Hartford (jon@outland.net)
Date: Thu Dec 25 1997 - 18:08:17 EST


> We are using many 2501s, 2511s, 7507 and many sunsparc workstations which
> are all connected to Cisco 1900 switching hub. However, today I have found
> that all the routers 2501s, 2511s and sunsparc workstations which generate
> a large number of packets with a destination address 207.17.227.186 and
> 209.45.172.124. Those unknown packets take a lot of our outgoing bandwidth
> of 7507.
>
> I suspect the switched hub has problem and I'm going to reset the 1900 or
> swap to a normal hub if the problem still exists. Do you have any idea or
> experience for this happening?
>
> Humphrey
>

Humphrey, what kind of packets are they? Is it possible somebody from
those addresses is recieving some kind of data from your LAN?
Possibly unauthorized data? Is it possible those are forged packets?

Can you trap a bunch of them to check? I would think it highly unlikely
that the cisco hub or routers are causing this.

Perhaps put a packet sniffer on the LAN?

-Jon



This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:13:14 EDT