[j-nsp] Strange behaviour on a M10...

[Kevin Oberman]

> Date: Fri, 4 May 2007 17:10:22 +0100 (WEST)
> From: Carlos Friacas <cfriacas at fccn.pt>
> Sender: juniper-nsp-bounces at puck.nether.net
> 
> 
> Hello,
> 
> We're experiencing a strange behaviour in one of our M10s.
> 
> The router (which is handling the full routing table) seems to keep 
> forwarding packets, but it's almost impossible to telnet to it, and it 
> shows 70% packet loss when pinging to a directly connected router. It 
> also shows 5x times higher latency on the 30% of well suceeded ICMPs. 
> Using the console, the processor and the routing engine levels of 
> processing seem to be low and ok. I'm currently using 7.6R4, and also
> tried 8.2R2 and 7.6R3.
> 
> Already skimmed through Juniper's problem reports, and i can't find 
> anything simmilar. At the moment i'm not fully sure the origin of this 
> isn't an attack, because the behaviour is not uniform/constant...
> 
> Has anyone seen anything close to this?

Oh, yes, but the information provided is too minimal to guess at the
cause.

The Route Engine communicates with the forwarding engine via a 100 Mbps
Ethernet. Something is filling up this path so that communication with
the RE is slowed to a crawl.

JUNOS reserves 10% of the bandwidth on this path (10 Mbps) for the
exclusive use of the routing daemon to communicate with the forwarding
engine, but pings, telnet (do people still use telnet?), ssh, and most
everything other than routing updates uses that path. If something is
sending a lot of data over fxp1, that would cause exactly what you are
seeing. Of course, this traffic may not originate locally and that i why
you really want to carefully protect that path by filtering access to
lo0. 
-- 
R. Kevin Oberman, Network Engineer
Energy Sciences Network (ESnet)
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)
E-mail: oberman at es.net			Phone: +1 510 486-8634
Key fingerprint:059B 2DDF 031C 9BA3 14A4  EADA 927D EBB3 987B 3751
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 224 bytes
Desc: not available
Url : https://puck.nether.net/pipermail/juniper-nsp/attachments/20070504/0d84498f/attachment.bin