Code Red

Fri Jul 20 06:43:09 UTC 2001

On Thu, 19 Jul 2001 lucifer at lightbearer.com wrote:

> Reports from our monitoring systems saw the CPU usage jump by somewhere
> between 150-200% for our core routers today; our current theory is that

One of our downstreams with a /20 had not nullrouted their /20, so any
nets not in use bounced back to us via their default route. This caused
approx 4-8 megabit of traffic on their line due to all the scanning. After
our customer put in a null route for their /20, the traffic problem
ceased.

The ping-pong routing was causing his 2600 to use a lot of cpu. I do
expect most people to null route their nets, but if someone hasn't, this
can cause problems due to scanning.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se