hELLO.   the problem was resolved.   the source of the problem was a movil (celular) phone blocking equipment installed near the factory. we had done to change the operation frequency from 2.4 to 5.0 GHz.   attn. ... View more

Enrico.   I have found this link associated with this type of anomalous traffic thst is using the protocolo and port: ldap (389 tcp) ldap (389 udp)   http://tools.cisco.com/security/center/viewAlert.x?alertId=30573   http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=30519   https://technet.microsoft.com/library/security/ms13-sep   https://technet.microsoft.com/library/security/ms13-079   can you tell me if this anomalous traffic is associated with this type of attack?   waiting your sooner answer.   attn.   Roger Majo ... View more

Hi Enrico. I mean packets that are propagated to other remote routers and internet. For example, in the LAN interface of this router I see coming paquets from 10.39.4.3 making ping (2040 icmp) to the following ip addresses: 8.8.8.8 (this is a public address) 10.72.1.1 (this is a server localted in other remote office) 10.11.20.1 (this is a PC localted in other remote office) 10.110.200.1 (this is the default gateway of local router) when I make ping to the ip address: 10.39.4.3 it does not response. the command sh arp does not show nothing. these paquets are propagated at this moment to only three remote branches. we have determined the source of these paquets and this is the router 2911/k9 locates in a branch office with a lan segment: 10.110.x.y/16. in this lan segment 10.110.x.y/16 does not exist the segment 10.39.4.x/24. I have made ping test to this address, then sh arp to determine tha mac-address but does not appear nothing. at switches does not appear nothing also. If this is the case of ip spoofing uRPF, can you tell me what can I do, please? tha paquets with a source address 10.39.4.x are using a source port number "0". please see the attached file.   waiting your sooner answer.   attn.   Roger Majo     ... View more

Leo.   i am sorry I do not understand your question o request. this anomalous segment is originated in a router cisco 2911/k9 I think by itself. the network segment 10.39.4.0 /24 is not connected to the LAN interface. this traffic is present at real time in many other routers but we have detected the origen at cisco router 2911/k9. what information do you need? what kind of test do your recommend to overcomes this problem?   Attn.   Roger Majo ... View more