ROUTER 3945 - ARP TABLE OVERWRITE DoS ATTACK

[ROGER FERNANDO MAJO ZACARIAS]

Hello,

We are having problems with a two router 3945 in HSRP and a switch 2960.

The two routers are connected to the switch 2960 through differentes ports.

The problem is that we loose connection between the router and the switch.

When we excute the command: show cdp neighbor at router, it shows nothing.

If we try to make ping to the 2960 switch it is no reachable.

If we make ping to the other router 3945 it is not reachable.

All other function of the router are o.k.

We are attaching the IOS of the routers and switch 2960 and a document in which make reference to a BUG in which mention about arp overwrite due arp attack which produce DoS.

Can somebody tell me how to avoid this type of problem, please?.

thanking you in advance.

Roger Majo

[paolo bevilacqua · Accepted solution]

To post version or other test, simply cut and paste, do not use attachments.

Other that that, update switch IOS and try again.

[ROGER FERNANDO MAJO ZACARIAS]

Hi Paolo,

Those router 3945 have the last IOS and have interchanged between them.

Today the process cpu at the main router has reached a 100% value.

When we disconnect the interface Giga from the switch 2960 used as core, the process cpu decrease inmediately to 10% and when we connect again the interface Giga to the switch 2960 the process inmediately reach 100%.

We are very sure that the problem is caused by internal traffic which oversubcribe tha cpu of the router.

Can you tell me what other test we can do to demonstrate that the problem is located into the user network?

Attn.

Roger Majo