Blog Posts in May 2008
Much ado about rootkits
- I was wrong.
- I'm really impressed.
The rootkit presentation prompted Cisco to generate an excellent document describing how to detect patched IOS images and the precautions you can take to ensure an intruder does not get access to your devices.
On the other hand, I was bitterly disappointed by the lack of coverage from the "industry press". There was speculation that Cisco released three patches in anticipation of the presentation (anyone who looked into what those patches were would easily find out that two of them were not IOS related) and a few notable exceptions correctly describing the situation, but some publications that were very loud before the presentation forgot to tell their readers that the threat was "slightly" over-rated. Of course, the lack of interest in non-sensational news has already started conspiracy theories.
If you want to have more details, read a down-to-earth description of the presented rootkit by Nicolas Fischbach.
Display CPU utilization with every show command
… updated on Monday, December 28, 2020 07:58 UTC
Conditional BGP Route Origination
Sebastian Majewski has found an interesting feature: if you use the network route-map BGP configuration command to originate BGP prefixes and use the match conditions within the route-map, BGP inserts the IP prefix in the BGP table only if the source route in the IP routing table satisfies the route-map conditions.
… updated on Tuesday, November 17, 2020 11:16 UTC
Continuous display of top CPU processes
When you have to monitor which processes consume router’s CPU over a period of time, a Tcl script that emulates the Unix top command might come handy. The following Tcl script continuously displays top 20 Cisco IOS processes and refreshes the update every 5 seconds.
Installation
- Download the source file into flash:top.tcl.
- Configure alias exec top tclsh flash:top.tcl.
- Invoke with top.
Usage guidelines
Usage: top [ 5sec | 1min | 5min ]
The script changes the escape character to Ctrl/C. Use terminal escape default to restore default settings
Source code
#
# title: Emulate the Unix top command
# name: top.tcl
# desc: The script displays top CPU processes every 5 seconds
#
# ios config:
#
# * download the file into flash:top.tcl
# * configure alias exec top tclsh flash:top.tcl
#
# invoke with top [5sec|1min|5min]
#
set IOS [string equal $tcl_platform(os) "Cisco IOS"];
if { $IOS } {
exec "terminal international";
exec "terminal escape 3";
}
set arg [lindex $argv 0];
if { [string length $arg] == 0 } { set arg "5sec" } ;
if { [lsearch -exact { 5sec 1min 5min } $arg] < 0 } {
puts {Usage: top [5sec|1min|5min]};
return 0;
}
fconfigure stdout -buffering none;
while {1} {
set lines [split [exec "show process cpu sorted $arg | exclude 0.00% +0.00% +0.00%"] "\n"];
puts -nonewline "\033\[2J\033\[H";
for { set lc 1 } { $lc < 23 } { incr lc } {
set curline [lindex $lines $lc];
if { [string length $curline] > 0 } { puts "$curline"; }
}
puts -nonewline "\nBreak with Ctrl/C --> ";
after 5000;
}
Router architecture books
Can you please recommend me literature explaining the architecture of Cisco routers and switches (buffers, control-plane, forwarding-plane, process switching …)The best one I've found so far is the Inside Cisco IOS Software Architecture
, but it's a bit old, so if you've found something better, please comment.Full disclosure: if you click on the link above and buy the book, I might eventually get $1.76 from Amazon.
Cable modem problems with Cisco 871
- The router and the cable modem are power-cycled.
- The router starts to bridge between all LAN interfaces, effectively connecting inside workstations directly to the cable modem.
- One of the workstations could detect a LAN failure (due to router reload) and restart the DHCP process (a Windows XP host would definitely do that).
- The DHCP requests from the workstation are bridged straight to the cable modem which caches the workstation's MAC address and forwards the DHCP request.
- The workstation is assigned a public IP address (at this time, the workstation is connected directly to Internet and thus vulnerable).
- The router loads Cisco IOS and reinitializes the Ethernet interfaces. Bridging between internal and external interfaces is stopped.
- The router sends DHCP request on the outside interface, but the modem ignores it, as the MAC address of the DHCP request differs from the previously cached one.
In most cases, the cable modem has to be power-cycled to lose the cached MAC address.
This behavior can be observed only if the router and the cable modem are reset at the same time and the cable provider doesn't care much about MAC security and allows the modem to learn the MAC address. If you reset only the cable modem, the router is not bridging (no problem); if you reset just the router, the cable modem still caches the router's MAC address and ignores the DHCP request from the inside workstation(s).
… updated on Friday, December 4, 2020 17:41 UTC
Multihoming to a Single ISP
Multihoming to a single ISP is a design scenario in which a customer uses multiple Internet connections to the same Internet Service Provider. This design provides resilience against link and device failures, but does not provide protection against major outages within the Service Provider network.
There are three major decisions to be made when designing multihoming to single ISP:
- Will the customer use provider-assigned or provider-independent address space?
- Should the customer use static or dynamic routing with the ISP?
- When using dynamic routing with BGP, does the customer need its own public autonomous system?
Guide to Harden Cisco IOS Devices
However, the Cisco's response to this announcement (which was basically saying "we haven't seen anything new yet") included a nice gem: a link to the Cisco Guide to Harden Cisco IOS Devices document.
… updated on Tuesday, January 5, 2021 07:47 UTC
Using IP Prefixes, AS Numbers and Domain Names in Examples
Keep in mind: Use private IP addresses, AS numbers and domain names in all technical documentation you're producing (unless, of course, you're describing an actual network). If you're forced to use public addresses or AS numbers (for example, to illustrate how the neighbor remote-private-as command works), you should clearly state that they are imaginary.
You can safely use:
Control Plane Protection inbound packet classification
Use the latest 12.4T software (at least 12.4(15)T5) if you want reliable CPPr operation.
- control-plane aggregate service-policy disables any control-plane subinterface service policies.
- If you want to use the per-subinterface (host, transit and cef-exception) policies, you have to remove the inbound service policy from the control-plane aggregate path.
- Routed packets that cannot be CEF-switched (have to be punted to another switching mechanism) are classified as transit packets.
- Local multicast packets with destination IP addresses within IP prefix 224.0.0.0/24 and packets with TTL <= 1 are classified as transit packets in 12.4(15)T5. These packets will be classified as cef-exception packets in the future (see the Understanding CPPr document).
- Unicast packets without IP options addressed to the router and having TTL > 1 are classified as host packets.
- Non-IP traffic (ARP, Frame Relay keepalives, CDP ...) is classified as cef-exception.
The TTL-related rules explain why the router classifies IBGP packets as host packets and EBGP packets as transit packets. As soon as you configure neighbor ebgp-multihop on the router router, inbound EBGP packets become host packets.
Which routing protocol do you use?
The situation has probably changed over the last years, I would (sadly) expect EIGRP to decline and (happily) BGP to grow. Let's figure it out; please respond to this week's readers' poll. Of course you can choose more than one routing protocol.
Cisco 851 and 871 bridge between LAN and WAN interfaces during boot process
Our security experts have replicated the behavior and reported it to Cisco PSIRT. Fortunately it's a known vulnerability, documented as CSCsd60259 (release note is available on CCO to registered users) and fixed with a ROMMON upgrade.
New routers are shipped with new ROMMON version, so you shouldn't be seeing this behavior on brand new boxes … but one cannot help but wonder why such a nasty behavior was not documented as a field notice/security advisory.
RTBH links (and thanks for the acronym :)
The search results produced a few very interesting links, among them a well-structured presentation on RTBH that refers to a paper describing how you can detect remote DoS attacks with the backscatter analysis (assuming the attackers are randomly spoofing source IP addresses).
How do you know you're an SP-geek
- You're creating a multi-AS BGP test lab on Sunday evening;
- The core AS is running 12.2SRC code;
- You insert a P-router in the core network ... because every large network has P-routers;
- You create BGP session templates instead of configuring two parameters of a few IBGP neighbors;
- You configure MPLS in the core network instead of using BGP on all routers ... because it saves you a few BGP sessions ... and that's the way things should be done anyway;
- When configuring OSPF, you define inter-AS links as passive interfaces ... not because you're running OSPF in the other AS but for security reasons :)
- ... add your comment here ...
Please Comment: Is Asymmetric Routing Harmful?
We've always been trying to minimize asymmetric routing, in both design and implementation phase, as it impacts a number of IP services/features, including:
- Network Address Translation;
- Content-based Access Control (CBAC);
- Reflexive access lists;
- Redundant firewalls (at least until recently);
- IP Multicast;
In some scenarios, asymmetric routing can impact delay/jitter and consequently the perceived quality of service.
However, asymmetric routing is a reality within the Internet (it's close to impossible to guarantee symmetric routing even for multi-homed end users) and it might even help in some scenarios (low-speed/low-delay upstream link with high-speed/high-delay downstream link).
What's your opinion? Is asymmetric routing harmful? Should we strive to avoid it ... or do you just accept it as one of facts of life?
The “fallback global” VRF option does not exist in Cisco IOS
I'm reading your book MPLS and VPN Architecturesand I've found the ip vrf forwarding name fallback global command in the “Additional Lookup in the Global Routing Table” section. I can only find this command in Junos, but not in IOS.
… and he was right. When we were writing the book, we described several features that were still in development as it looked like they would be in the production code by the time the book was published. Many of them made it into the public IOS releases (for example, the Carrier's Carrier architecture), but some of them (like this command) simply vanished from the surface.
However, it looks like the engineers that switched from Cisco to Juniper took the concept with them and implemented it in JunOS, so JunOS has this feature but IOS doesn't.
This article is part of You've asked for it series.