Many DNS port 53 scaned packets detected in debug netdr

[aweer1234]

   Dear All,

    Our company have router cisco 7609-S and detected bunch of packets scan port 53  after running command with debug netdr capture packets,

As according to my understanding debug netdr function only detected with packets to cpu in control plane,so i don't understand why we have detected with such many data plane packets .All source and destination ip are different.

   Could you please guys help to advise how to solve this issue? 

   Thanks!

--

Regards,

Rex

[Masoud Pourshabanian · Accepted solution]

Hello,

RP process handles some traffic indeed. Please check the information below. Check the DNS packets with sniffer to see what is going on. Look for options in the packets for example.

"The RP CPU is typically used in order to handle Layer 3 (L3) control traffic as well as L3 data traffic that cannot be hardware-switched. Some examples of L3 control traffic are Open Shortest Path First (OSPF), Enhanced Interior Gateway Routing Protocol (EIGRP), Border Gateway Protocol (BGP), and Protocol Independent Multicast (PIM) packets. Some examples of L3 data traffic that cannot be hardware-switched are packets with IP options set, packets with Time To Live (TTL) values of 1, and packets that require fragmentation"

Masoud

[aweer1234]

Hi Masoud,

I have attached debug netdr report in this thread,could you please help to check it if there any problem? 

Thanks!

Regards,

Rex

[Masoud Pourshabanian]

I see these IPs a lot.

Is one of them yours?

23.251.55.X

150.129.7X.X?

Masoud

[aweer1234]

Hi Masoud,

All these ips not belong to us,thank you!

Regards,

Rex

[Masoud Pourshabanian]

And do you any access-list with "log" at the end?

[aweer1234]

Hi Masoud,

Thanks for your reply!

We don't have any access-list with "log" option enabled.
Thanks!

Regards,

Rex

[Amit Goyal]

Hi Rex,

Yes you are right. debug netdr gives us all packets which are being punted to cpu.

Can you attach the output of "debug netdr" in this thread?

You could also check the destination of those packets if they belongs to your 7600 router. if not, then for some reason they are being pushed to this router unexpectedly.

HTH

-Amit

[aweer1234]

Hi Amit,

Could you please check attach file for your reference,i did find a lot of destination ips not belong to our router,but from servers which connected to distributed switch and then router,thanks!

--

Regards,

Rex