RE: Matching SQL with NBAR

From: Akaradeth.N@datacraft-asia.com
Date: Tue May 09 2006 - 00:33:48 ART


Hi Kenny,

 

No not yet, my first attempt is on 3 July I will let you know the result :-)

 

But my friend he took an exam on 26 April, and failed, it's normal (he will
take again on 26May). He told me that there is fault injection (or
troubleshooting) for the first section, if you can fix for 2 faults will get
3 points, something like this. It has about 6 fault items.

 

He told that it is in below issue:

- IP/Subnet mask

- Speed/ Duplex

- Allow vlan on trunk

- VTP mode, vlan, native vlan

- Spanning tree

 

- Frame Relay, encapsulation, lmi-type

 

- Clock rate

 

As Scott said the best way to troubleshoot is pinging on directly connected
interface. Troubleshoot it step by step, link by link. If you finish it
within 1 hr, it will be the best chance, a lot of remaining time for
remaining questions.

 

Please note that this troubleshooting is in L2, it you can't fix it, you
will be in trouble :S

 

Cheers,

Akaradeth

 

 

-----Original Message-----
From: allboutcisco [mailto:frenzeus@streamyx.com]
Sent: Monday, May 08, 2006 8:42 PM
To: Akaradeth N@MS@DCTH-BKK
Subject: Re: Matching SQL with NBAR
Importance: Low

 

Hi Akaradeth,

 

U went for ur first attempt? How was it? I asked a colleague of mine to do a

comparison between IEWB vs the-REAL lab, he said IEWB was tougher. Any

comments?

 

I've scheduled my 1st attempt on August in sydney.

 

Would like to look for someone to discuss more on the concepts & practical

as i prepare for the lab.

 

Thanks.

 

Cheers,

Kenny

 

----- Original Message -----

From: <Akaradeth.N@datacraft-asia.com>

To: <frenzeus@streamyx.com>; <ccielab@groupstudy.com>

Sent: Monday, May 08, 2006 1:57 PM

Subject: RE: Matching SQL with NBAR

 

 

> At my first try, I did it like your way, and I think this way is correct,

> it

> is another way for us who don't know that the "protocol sqlserver" is UDP

> port 1434.

>

>

>

>

>

> It is a good posting to let us know a good option for us, I think.

>

>

>

> Akaradeth

>

>

>

> -----Original Message-----

> From: nobody@groupstudy.com [mailto:nobody@groupstudy.com]

> Sent: Sunday, May 07, 2006 11:31 AM

> To: Cisco certification

> Subject: Matching SQL with NBAR

>

>

>

> Hi group,

>

>

>

> Was working through IEWBv3 Lab 15, Task9.1; where the task is to match on

> SQL Slammer worm in particular packets with size of 404 byte destined for

> UDP port 1434. So i did a check from Doc cd (& also a show ip nbar port) &

> noticed that the nbar is matching sqlserver on TCP port 1433. So instead

> of

> matching directly (as per solution guide) protocol sqlserver, i did a

> custom

> mapping with "custom-01" to UDP port 1434. Would it be right to do it this

> way?

>

>

>

> Since if i use "protocol sqlserver" directly, it matches sql packets to

> TCP

> port 1433, would it still match the SQL slammer which instead uses UDP

> port

> 1434 (as given in the task)?

>

>

>

> ip nbar port-map custom-01 udp 1434

>

> !

>

> class-map match-all SQLWORM

>

> match protocol custom-01

>

> match packet length min 404 max 404

>

> !

>

> policy-map TASK9.1

>

> class SQLWORM

>

> drop

>

> !

>

>

>

> Would this be correct? Thanks everyone in advance.

>

>

>

> Cheers,

>

> Kenny

>

>

>

> _______________________________________________________________________

>

> Subscription information may be found at:

>

> http://www.groupstudy.com/list/CCIELab.html

>

>

>

>
****************************************************************************

> This email and all contents are subject to the following disclaimer:

>

> http://www.datacraft-asia.com/disclaimer

>
****************************************************************************

>

> _______________________________________________________________________

> Subscription information may be found at:

> http://www.groupstudy.com/list/CCIELab.html



This archive was generated by hypermail 2.1.4 : Thu Jun 01 2006 - 06:33:21 ART