Router / Protocol Problem

Michael.Dillon at Michael.Dillon at
Thu Sep 7 12:11:44 UTC 2006

> Apparently some how this connection is being
> >matched via NBAR for good old Code Red.

> Best moved to cisco-nsp.

Network operator discovers that measures taken to mitigate
an old network security measure, long past their sell-by
date, are now causing random grief. Seems to me like
bang on topic for NANOG. What other such temporary mitigating
measures are still in place long after the danger has passed.

Note, that Code RED was a both an application vulnerability
and a network DDoS. Even though there are likely still many
hosts running the vulnerable application, the number is not
sufficient to cause another massive DDoD and measures taken
to protect against this particular peculiar DDoS, really 
don't have a good technical reason to remain in place.

This is probably also another instance of the well-known
ops problem: We know how to get stuff deployed but we
can't undeploy stuff because we are too busy deploying
other stuff.

--Michael Dillon

More information about the NANOG mailing list