Re: [j-nsp] DOS Attack

2010-08-04 Thread Stefan Fouant
> -Original Message- > From: juniper-nsp-boun...@puck.nether.net [mailto:juniper-nsp- > boun...@puck.nether.net] On Behalf Of sherif mostafa > Sent: Wednesday, August 04, 2010 9:37 AM > To: fwei...@bfk.de > Cc: juniper-nsp@puck.nether.net > Subject: Re: [j-nsp] DOS Att

Re: [j-nsp] DOS Attack

2010-08-04 Thread sherif mostafa
Dear Florian, This ERX, Administration of router interface 0018.742f.b380 belongs to me also, but should I filter all those packet types ?? > To: sherifmka2...@hotmail.com > CC: juniper-nsp@puck.nether.net > Subject: Re: [j-nsp] DOS Attack > From: fwei...@bfk.de > D

Re: [j-nsp] DOS Attack

2010-08-04 Thread Florian Weimer
* sherif mostafa: > Could anyone help please as I've faced an error message "DOS" below > that caused high CPU usage: > ERROR 08/02/2010 16:22:46 CAI dosProtection: Flow is suspicious: > GigabitEthernet11/0.410 for control protocol: IP TTL Expired source MAC > 0018.742f.b380 with rate 241 pps Ha

[j-nsp] DOS Attack

2010-08-03 Thread sherif mostafa
Dears, Could anyone help please as I've faced an error message "DOS" below that caused high CPU usage: ERROR 08/02/2010 16:22:46 CAI dosProtection: Flow is suspicious: GigabitEthernet11/0.410 for control protocol: IP TTL Expired source MAC 0018.742f.b380 with rate 241 pps ERROR 08/02/2010

Re: [j-nsp] DOS attack?

2009-05-20 Thread Matthias Gelbhardt
Hi! I may open a JTAC case, when I understand for which problem I should open one. The following has happened: The system (J6350) is running under 9.3R2.8, so we decided to update to 9.4R2.8. That was a desaster, and I hope you can help also in this matter. After upgrading the systems, b

Re: [j-nsp] DOS attack?

2009-05-17 Thread Richard A Steenbergen
On Sun, May 17, 2009 at 02:19:56AM -0700, Robert Raszuk wrote: > Hi Matthias, > > > I wonder now, which is the event, that triggered this behavious? The > > numer of ssh-logins at that time or this zbexpected EOF? > > I would with good deal of assurance conclude that the cause were > ssh-login a

Re: [j-nsp] DOS attack?

2009-05-17 Thread sthaug
> The advice would be to: > > * open a case with jtac to find out why subsequent ssh-logins cause a > memory leak > > * reduce to very max rate-limiting for the ssh logins Or even better - configure a firewall filter which limits ssh logins to your "trusted" netblocks - typically where your man

Re: [j-nsp] DOS attack?

2009-05-17 Thread Robert Raszuk
Hi Matthias, > I wonder now, which is the event, that triggered this behavious? The > numer of ssh-logins at that time or this zbexpected EOF? I would with good deal of assurance conclude that the cause were ssh-login attack which apparently starved the poor box to it's memory limits. When e

[j-nsp] DOS attack?

2009-05-17 Thread Matthias Gelbhardt
Hi! Last night we had a mysterious behaviour on our router. On a BGP connection with Cogent we received an unexpected EOF. There were also a great number of SSH logins (we do not have FW rules in place, but we have a rate limit, Shortly after the router complained about low memory and a