[40292] in North American Network Operators' Group
Re: TCP session disconnection caused by Code Red?
daemon@ATHENA.MIT.EDU (George William Herbert)
Mon Aug 6 14:42:49 2001
Message-Id: <200108061857.LAA02866@gw.retro.com>
To: mike harrison <meuon@highertech.net>, nanog@merit.edu
Date: Mon, 06 Aug 2001 11:57:10 -0700
From: George William Herbert <gherbert@retro.com>
Errors-To: owner-nanog-outgoing@merit.edu
mike harrison <meuon@highertech.net> wrote
>Blaz Zupan <blaz@amis.net> wrote:
>> For the last few days, our network seems to be basically unreachable from the
>> outside. Most incoming TCP sessions (web requests, incoming mail, telnet
>> sessions, etc.) often fail with a simple "Connection refused" like nobody is
>
>Your routers are brain dead from the load.. routers that are used to
>handling a few thousand connections are being asked to handle 10's of
>thousands. 1 good 1000+ address scan from an ISDN user kills my
>Lucent/Ascend TNT unless we filter for it.
I've been told (but not given permission to forward details of
who/how/what) that some major sites with a single router
and relatively flat network topology are dying due to the ARP
request flood that is being generated by Code Red scans on the
inside of their border router choking the router. Check the
rate of ARP requests coming off your border router and see if
it seems excessive; if so, that may be it.
-george william herbert
gherbert@retro.com
