华为9306交换机ICMP包攻击导致直连丢包但业务不受影响故障处理

1、华为9306交换机ICMP包攻击导致直连丢包但业务不受影响故障处理故报告故障现象描述与说明故障现象：r kr k| i3Jt| k?1 tJH. !n Elb1 Zii抄 HMH*1iih网络情况:华为9303交换机华为9306交换机故障现象及处理步骤一：1、在交换机9306-B上通过命令display logbuffer查看Apr 23 2012 14:25:16 JM-SN5L-DCN-9306-2 %01QOSE/4/CPCAR_DROP_LPU(l): Some packets aredropped by cpcar on the LPU in slot 1. (Protocol=ic

2、mp, Drop-Count=0529546)Apr 23 2012 14:25:16 JM-SN5L-DCN-9306-2 %01QOSE/4/CPCAR_DROP_MPU(l): Some packets are dropped by cpcar on the MPU. (Protocol=icmp, Drop-Count=049663)Apr 23 2012 14:15:16 JM-SN5L-DCN-9306-2 %01QOSE/4/CPCAR_DROP_LPU(l): Some packets are dropped by cpcar on the LPU in slot 1. (Pr

3、otocol=icmp, Drop-Count=0489843)Apr 23 2012 14:15:16 JM-SN5L-DCN-9306-2 %01QOSE/4/CPCAR_DROP_MPU(l): Some packets are dropped by cpcar on the MPU. (Protocol=icmp, Drop-Count=049826)Apr 23 2012 14:09:39 JM-SN5L-DCN-9306-2 %01HWCM/4/EXIT(l): Exit from configure mode.Apr 23 2012 14:05:16 JM-SN5L-DCN-93

4、06-2 %01QOSE/4/CPCAR_DROP_LPU(l): Some packets are dropped by cpcar on the LPU in slot 1. (Protocol=icmp, Drop-Count=0483657)大的icmp包到达设备后由主引擎和slotl的CPCAR进行丢弃。2、在交换机 9306-B 上通过命令 display cpu-defend statistics all 查看CPCAR on mainboardPacket TypePass(Bytes)Drop(Bytes)Pass(Packets)Drop(Packets)stp0000sm

5、art-link0000ldt0000lacp0000lldp0000dldp0000vrrp0000isis0000igmp0000pim0000rip0000ospf1406001320bgp88257011750mpls-rsvp0000mpls-ldp0000ttl-expired0000icmp118941948524911341828397807336eoam-3ah0000mpls-pi ng0000mpls-ttl-expired0000ntp0000ripng0000ospfv30000bgp4plus0000pimv60000hotlimit0000vrrp60000mld

6、1313001350icmpv60000telnet8007350125060ssh0000ftp0000snmp0000radius0000hw-tacacs0000tcp1405201980mpls-fib-hit0000fib-hit0000arp-miss1630202070unknown-packet0000hopbyhop0 000pppoe0 000bpdu-tunnel0 000rrpp0 000udp-helper0 000CPCAR on slot 1Packet TypePass(Bytes) Drop(Bytes)Pass(Packets)Drop(Packets)ar

7、p-request1196801760arp-reply44200660stp0 000smart-link0 000ldt0 000lacp0 000lldp0 000dldp0 000vrrp0 000mpls-oam0 000isis0 000dhcp-client0 000dhcp-server0 000igmp0 000pim0 000rip0 000ospf21229620229630bgp91561011750bfd0 000mpls-rsvp0 000mpls-ldp0000ttl-expired143622014530icmp1807881466220681962626569

8、9079349eoam-3ah0000eoam-1ag0000mpls-pi ng0000mpls-ttl-expired0000ntp00008021x0000http0000ripng0000ospfv30000bgp4plus0000pimv60000hotlimit0000vrrp60000dhcpv6-request0000dhcpv6-reply0000mld1367001350icmpv60000hvrp0000telnet853955136125532ssh0000ftp0000snmp0000radius0000hw-tacacs0000tcp1339201800mpls-f

9、ib-hit0000fib-hit90000900arp-miss1703402070unknown-packet0000unknown-multicast1371734801666540hopbyhop0000pppoe0000bpdu-tunnel0000从上述很容易看出：大的ICMP经交换机处理不过来从而丢弃。步骤二：在交换机9306上开启ICMP的debug信息找出具体的攻击源。通过在交换机上执行debugging ipicmp，发现从鹤山上来的主要有/24、/24、 /24三个网段的源进行大量的icmp包。于是建议客户要求鹤山本地关注这些网段的终端进行病毒扫描处理。步骤三：业务恢复（

10、在交换机上针对上述的三个网段的ICMP包进行黑名单处理）acl number 3100rule 5 permit icmp source 55rule 10 permit icmp source 55rule 15 permit icmp source 55#cpu-defend policy 1blacklist 1 acl 3100#slot 1cpu-defend-policy 1处理后，icmp处理恢复正常，直连ping也不再丢包。并且观察了一天后，也正常。因此，攻击源在鹤山本地。处理过程信息LOG编号文件名说明1警930& bb. loaLOG文件应包含设备的软件版本信息、硬件配置信息、处 理过程日志等内容。根本原因分析1、华为9300系列交换默认隐藏模式下有针对各种报文的QOS限速机制，当对应的报文超出设定的速率 值时，由CPU-DEF