Possible Sudden Uptick in ASA DOS?

Wed Jul 8 17:45:55 UTC 2015

This is pretty scary when you take into account that the NYSE is still down.

Kirill Klimakhin
Principal Consultant
120 Seventh Street
Suite 202
Garden City, NY 11530
(C) 631-707-3303
(F) 631-982-0174
Kirill.Klimakhin at corebts.com
www.corebts.com

-----Original Message-----
From: NANOG [mailto:nanog-bounces+kirill.klimakhin=corebts.com at nanog.org] On Behalf Of Mark Mayfield
Sent: Wednesday, July 08, 2015 12:58 PM
To: nanog at nanog.org
Subject: Possible Sudden Uptick in ASA DOS?

Come in this morning to find one failover pair of ASA's had the primary crash and failover, then a couple hours later, the secondary crash and failover, back to the primary.

Another pair running the same code had the primary crash and fail in the same time window.

So, three crashes in 4 hours in our environment.

Open a TAC case on one of these for post-mortem analysis, and they interpreted the crash dump to point at a DOS bug first published in Oct.

The very interesting thing; on the phone the TAC engineer said this was "the 10th one of these I've dealt with this morning".

Here's the bug they reference:
https://tools.cisco.com/bugsearch/bug/CSCul36176/?reffering_site=dumpcr

Anyone else have observations to add on this?

Mark Mayfield
City of Roseville - AS 54371
Network Systems Engineer

2660 Civic Center Drive
Roseville, MN 55113
651-792-7098      Office

________________________________
Important Notice: This email message and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Core BTS. Core BTS specifically disclaims liability for any damage caused by any virus transmitted by this email.