[nsp] show ip cache flow -- Same SrcIf and DstIf?

[Devon True]

Stephen,

To make sure I understand. :) 

Packets are coming into Se1/1/0/9:0 with spoofed SrcIPs,
but the DstIP is back towards IPs that the DstIf is Se1/1/0/9:0, thus
creating this scenerio.

What would the purpose of this be?

You are right, this is a leaf node.

Devon

On Thu, 9 Oct 2003, Stephen J. Wilcox wrote:

> 
> Is it possible that the packets came in on the Serial with possibly spoofed src 
> address (assuming the serial is a leaf/stub node) .. this would produce this 
> output..
> 
> Steve
> 
> On Thu, 9 Oct 2003, Devon True wrote:
> 
> > All:
> > 
> > Has anyone seen "show ip cache flow" output that shows the same
> > interface for both SrcIf and DstIf? The SrcIP is an Internet host and
> > the DstIP is a host across a serial interface. Example:
> > 
> > SrcIf         SrcIPaddress DstIf         DstIPaddress  Pr SrcP DstP Pkts
> > 
> > Se1/1/0/9:0   209.x.x.131  Se1/1/0/9:0   69.x.x.126    11 98F2 0035 22
> > Se1/1/0/9:0   213.x.x.130  Se1/1/0/9:0   69.x.x.126    11 0400 0035 568
> > Se1/1/0/9:0   24.x.x.250   Se1/1/0/9:0   69.x.x.2      11 0035 0035 2596
> > Se1/1/0/9:0   24.x.x.250   Se1/1/0/9:0   69.x.x.3      11 0035 0035 480
> > Se1/1/0/9:0   66.x.x.143   Se1/1/0/9:0   69.x.x.2      11 8003 0035 25
> > Se1/1/0/9:0   66.x.x.145   Se1/1/0/9:0   69.x.x.2      11 8004 0035 25
> > 
> > Octets changed to protect the innocent. :)
> > 
> > Devon
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> > 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>