01-24-2007 03:54 AM - edited 03-09-2019 05:15 PM
I noticed a number of failed console port logins in our tacacs logs from a couple of remote routers. In both cases the usernames are gibberish - random characters in one case; access-list logs in the other.
logging in to these 2 routers (both 870s)I can see a lot of noise on the console ports. Anyone know what could be causing this?
router#sh line
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
0 CTY - - - - - 0 46524396 374144/0 -
1 AUX 0/0 - - - - - 0 0 0/0 -
* 2 VTY - - - - 61 5 0 0/0 -
3 VTY - - - - 61 0 0 0/0 -
4 VTY - - - - 61 0 0 0/0 -
5 VTY - - - - 61 0 0 0/0 -
6 VTY - - - - 61 0 0 0/0 -
sample log:
01/24/2007 11:19:35 Authen failed | ACCESSLOGP: list 101 denied udp 192.175.48.6(53) -> 87.42.147.10(54724) 4 packets | async | Invalid characters in username | tty0 | 192.168.20.62
01-24-2007 03:58 AM
Check and reverify your settings for the Async Console port. It should be 9.6k 8 data bits, 1 stop bit and no parity. You may have a mismatch somewhere, possibly the DTE equipment or even the setup on the router. Do a show line cty 0 and see how it is set up...
01-24-2007 04:17 AM
well there shouldn't actually be anything plugged into the console, though I have no way of checking this.
#sh line con 0
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
0 CTY - - - - - 0 46983615 374144/0 -
Line 0, Location: "", Type: ""
Length: 24 lines, Width: 80 columns
Baud rate (TX/RX) is 9600/9600, no parity, 1 stopbits, 8 databits
Status: Ready
Capabilities: none
Modem state: Ready
Special Chars: Escape Hold Stop Start Disconnect Activation
^^x none - - none
Timeouts: Idle EXEC Idle Session Modem Answer Session Dispatch
02:00:00 never none not set
Idle Session Disconnect Warning
never
Login-sequence User Response
00:00:30
Autoselect Initial Wait
not set
Modem type is unknown.
Session limit is not set.
Time since activation: never
Editing is enabled.
History is enabled, history size is 20.
DNS resolution in show commands is enabled
Full user help is disabled
Allowed input transports are none.
Allowed output transports are telnet.
Preferred transport is none.
No output characters are padded
No special data dispatching characters
looks ok to me.
01-24-2007 04:40 AM
Looks OK to me as well... Check to see if anything is actually plugged into it. You may have an open cable hanging off the port that is causing an antenna effect and causing impulse hits on the line. You may have bad cabling (A bad RJ-45 head or adaptor) or possibly the console port is defective...
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide