What causes input packets on Null0?

[Andrew Ward]

Hello, I wonder if anyone can tell me what are the possible causes for input packet hits on interface Null0? (I'm not talking about output packet hits caused by blackhole routing). I first noticed this on a 3800 VPN router, but I've now noticed it on a 6500.

Any ideas?

Thanks, Andy.

[sumitava123]

HI Andre ,

I am not able to understand your questions properly.The Null interface is typically used for preventing routing loops.

Can you please elaborate your question.

Sumit

[Andrew Ward]

Sumit,

see the output below:

6500-1#sho int null0
Null0 is up, line protocol is up
  Hardware is Unknown
  MTU 1500 bytes, BW 10000000 Kbit, DLY 0 usec,
     reliability 0/255, txload 0/255, rxload 0/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Last input never, output never, output hang never
  Last clearing of "show interface" counters 00:33:38
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     51827 packets input, 47751783 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out

I want to understand what the input packets are.

Thanks, Andy.

[sumitava123]

Hi ,

Can you please share the following command output.

sh ip route | i null

Regards

Sumit

[Andrew Ward]

Sumit,

on my 6500 I have 5 routing entries via Null0. These are 32 bit entries generated as a result of config which is on a CSM in the 6500.

But on my 3800 VPN router, there are not routing entries via Null0. So these input packet stats don't seem to be connected to the routing table entries.

I'm trying to get my head around the concept of a packet coming out of a Null0 interface. It seems a bit like light coming out of a black hole!

Thanks, Andy.

[Andrew Ward]

Does anyone else have any ideas on this? Or do you see similar stats when doing a 'show int null0' on your kit?

Thanks, Andy.

[shijomon scaria]

Hello Andrew,

Read the below passage by 'Scott Morris'

"The Null0 "interface" is a virtual bit-bucket. Meaning it's a trash can to route things to. There's automatically a Null0 route (called a Discard Route) created when you do a summary-address or area-range or things like that with routing protocols.

The idea behind this is that you are creating a summary address manually to tell other routers about. If you are therefore expecting to receive packets for anything within that summary range, what will your router do about it? if it has more specific routes, packets will get routed perfectly fine.

Anything not matching more specific routes would get sent to the discard route and therefore destroyed in a flash of Null0 mayhem. Without the discard route, your router would be either trying to look things up or possibly sending to a default route (0.0.0.0/0) it has in its table. This in turn, may cause a routing loop where the router with the 0/0 route contains the summary you manually advertised and so packets bounce needlessly until the TTL expires!

It's a protection mechanism.

You may also use Null0 as a destination in static routes if you would like particular packets to die a horrible death as well! "

I hope  this will give ur answer.

Regards,

Shijo.

[shijomon scaria]

Hello Andrew,

Read the below passage by 'Scott Morris'

"The Null0 "interface" is a virtual bit-bucket. Meaning it's a trash can to route things to. There's automatically a Null0 route (called a Discard Route) created when you do a summary-address or area-range or things like that with routing protocols.

The idea behind this is that you are creating a summary address manually to tell other routers about. If you are therefore expecting to receive packets for anything within that summary range, what will your router do about it? if it has more specific routes, packets will get routed perfectly fine.

Anything not matching more specific routes would get sent to the discard route and therefore destroyed in a flash of Null0 mayhem. Without the discard route, your router would be either trying to look things up or possibly sending to a default route (0.0.0.0/0) it has in its table. This in turn, may cause a routing loop where the router with the 0/0 route contains the summary you manually advertised and so packets bounce needlessly until the TTL expires!

It's a protection mechanism.

You may also use Null0 as a destination in static routes if you would like particular packets to die a horrible death as well! "

I hope  this will give ur answer.

Regards,

Shijo.

[Andrew Ward]

Shijo,

if my understanding is correct, that would cause output packets hits on Null0. I understand Null0's role in routing protocol loop prevention.

Does anyone else see input packet hits on Null0?  - I'm sure there is nothing very special about my setup.

Thanks.