RE: How I fixed the network I broke.

From: Jonathan V Hays (jhays@jtan.com)
Date: Tue Nov 25 2003 - 09:49:07 GMT-3


Michael,

I know that I personally am usually too embarrassed to report this sort
of thing but your posts may help many others. Thanks for having the
courage to share - it is appreciated.

Usually when I run into this kind of situation (I assume you didn't have
the luxury of putting a sniffer on the switch beforehand) I like to add
an ACL with a few "permit any log" statements and watch the log for a
while. However, I wonder if this is even possible with a VLAN map? Or
maybe I should ask, was it a VLAN map? And out of curiosity, what kind
of switch was it?

Thanks,

Jonathan

-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Michael Snyder
Sent: Sunday, November 23, 2003 10:42 PM
To: ccielab@groupstudy.com
Subject: How I fixed the network I broke.

What I broke was DHCP.
 

It seems when a client doesn't have ip address, it broadcasts to udp
255.255.255.255 from udp address 0.0.0.0 asking for a ip address.

I had allowed all normal unicast traffic, but didn't think about dhcp.

After a google search I added the following statement.

Permit udp host 0.0.0.0 eq 68 host 255.255.255.255 eq 67

The reason I thought of this for a Groupstudy posting, is couldn't you
envision this on the lab?

Have a good restrictive access list on interface, then much later in the
lab; they say also add dhcp to that router. I know I would just think
easy points and move on.

Just a thought.

------------------------------------------------------------------------
--------------

I had a real world experience to share.

Testing out ids, I found a lot of spoofed traffic on a clients network.

I believe it was one of the newer worms out at the time. I had a tech
tracking down the infected machines.

I noticed that a lot of the traffic was neither sourced nor destined for
the network I was on, and it wasn't on a transit network!

So, I figure I can take care of that, and threw a vlan filter on the
switch.

Where a.b.c.d = clients network.

Permit ip a.b.c.d 0.0.0.255 any
Permit ip any a.b.c.d 0.0.0.255

Get a call the next day. Network is broke.

Can anyone guess what I broke?

Continued on next email.

Michael Snyder
Lead Network Engineer
CCDP, CCSP, MCSE NT/2000
Revolution Computer Systems
(270) 443-7400



This archive was generated by hypermail 2.1.4 : Fri Dec 12 2003 - 12:29:17 GMT-3