Level3 routing issues?

Sat Jan 25 09:02:21 UTC 2003

Same here. One particular GigE port with a bunch of M$ servers on it
pegged at precisely 998 mbps. Lovely.

>
>
> Really bad.  Quick capture of filter drops:
>
> PROTO 17 (UDP) pkt from (IP's from all over the world)/1033 to (All my
> IP space)/1434 dropped
>
> On Sat, 25 Jan 2003, hc wrote:
>
>>
>> Okay this is getting bad.. one of our routers just locked up from udp
>> 1434's. Can't even telnet to it now.
>>
>> -hc
>>
>> Joel Perez wrote:
>>
>> >My firewalls are going nuts with hits on UDP port 1434 also from
>> >everywhere!
>> >
>> >	-----Original Message-----
>> >	From: Aaron Burnett [mailto:listkeep at yet-another.com]
>> >	Sent: Sat 1/25/2003 1:19 AM
>> >	To: Alex Rubenstein
>> >	Cc: hc; nanog at merit.edu
>> >	Subject: Re: Level3 routing issues?
>> >
>> >
>> >
>> >
>> >
>> >	On Sat, 25 Jan 2003, Alex Rubenstein wrote:
>> >
>> >	>
>> >	>
>> >	> I dunno about that. But, I am seeing, in the last couple hours,
>> >all kinds
>> >	> of new traffic.
>> >	>
>> >	> like, customers who never get attacked or anything, all of a
>> >sudden:
>> >	>
>> >	>
>> >http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.html>> >	>
>> >	>
>> >	> We are seeing this on ports all across out network -- nearly 1/2
>> >our ports
>> >	> are in delta alarm right now.
>> >	>
>> >	> Anyone else?
>> >	>
>> >
>> >	Yep. Since about 12:30 am. Getting pounded on UDP port 1434 from
>> >all over
>> >	the world to any address on my network.
>> >
>> >
>> >
>> >
>> >

-- 
Grant A. Kirkwood - grant(at)tnarg.org
Fingerprint = D337 48C4 4D00 232D 3444 1D5D 27F6 055A BF0C 4AED