RE: UDP flooding

From: Jonathan V Hays (jhays@jtan.com)
Date: Mon Jun 23 2003 - 14:40:40 GMT-3


Hi,

Sorry that I can't help you with understanding the mechanics of UDP
flooding. However, I think the point of 0xffffff 0x000000 is that there
*is* no OUI type with all ones, so it is sufficient to specify only half
the MAC address to match all broadcast packets.

> -----Original Message-----
> From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On
> Behalf Of wing_lam@jossynergy.com
> Sent: Monday, June 23, 2003 12:03 PM
> To: Jonathan V Hays
> Cc: ccielab@groupstudy.com
> Subject: RE: UDP flooding
>
>
> Hi Johnathan,
>
> Thx, I think the broadcast MAC will be with all 1's but I
> have no idea on
> the OUI type with all ones, even after I searched the following link:
>
> http://www.cisco.com/en/US/products/sw/iosswrel/ps1824/product
> s_command_reference_chapter09186a008008065d.html
>
> So I guess the example is wrong, and if it's my fault please
> let me know.
>
> But I still don't know how the "UDP flooding" works. In my
> perception, it
> means "UDP broadcast packets passing hope by hope with the destination
> broadcast address changes accordingly in each hope, and the
> spanning tree
> will deal with the forwarding and blocking; while other normal user
> traffics will still through unicast routing"
>
> Am I right, anybody please correct me; I am still not very
> clear in how the
> spanning-tree part of the "UDP flooding" functions.
>
> Thx a lot,
> BBD (Big Black Dog)
>
>
>
>
>
>
>
>
>
> "Jonathan V Hays"
>
>
> <jhays@jtan.com> To:
> <wing_lam@jossynergy.com>
>
> Sent by: cc:
> <ccielab@groupstudy.com>
>
> nobody@groupstudy Subject: RE:
> UDP flooding
>
> .com
>
>
>
>
>
>
>
>
> 06/23/2003 11:11
>
>
> PM
>
>
> Please respond to
>
>
> "Jonathan V Hays"
>
>
>
>
>
>
>
>
>
>
>
>
> > -----Original Message-----
> > From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On
> > Behalf Of wing_lam@jossynergy.com
> > Sent: Monday, June 23, 2003 10:22 AM
> > To: Connie Nie
> > Cc: ccielab@groupstudy.com
> > Subject: RE: UDP flooding
> >
> >
> > Also, what is the use of access-list 201 deny 0xffff 0x0000
> > in example?
>
> You are denying MAC addresses with OUI of all ones.
>
> HINT: So what type of MAC address would begin with all ones?
>
>
> ______________________________________________________________
> _________
> You are subscribed to the GroupStudy.com CCIE R&S Discussion Group.
>
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
> ______________________________________________________________
> _________
> You are subscribed to the GroupStudy.com CCIE R&S Discussion Group.
>
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html



This archive was generated by hypermail 2.1.4 : Fri Jul 04 2003 - 11:11:07 GMT-3