<div dir="ltr"><div>
<p class="gmail-article-name">Check if the device/junos run into this Vul?</p><p class="gmail-article-name">IPv6 Neighbor Discovery Crafted Packet Denial of Service Vulnerability (CVE-2016-1409) </p></div><a href="https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10749">https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10749</a><br><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 9, 2021 at 3:19 PM Dmitry Konchanin <<a href="mailto:dmitry.konchanin@dtsanz.com">dmitry.konchanin@dtsanz.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Seems like v6 this time, also big counters on ddos-protection
protocols ndpv6/neighb-sol and ndpv6/aggregate. Tho it does not
save routing engine. I guess it's time to have a good look on ipv6
RE input policer, they usually got lack of attention..<br>
</p>
<div>Kind regards,
<br>
<br>
Dmitry Konchanin <br>
Senior Network Engineer <br>
<font style="color:grey;font-size:13px">
_______________________________________________
<br>
⇒ New Zealand Office: 0508 387 669/+(64) 4 918 0160 extn 118 <br>
⇒ Australian Office: 1300 054 331/+(61) 7 5522 9726 extn 118 <br>
⇒ Website: <a href="http://www.DTSanz.com" target="_blank">www.DTSanz.com</a>
</font><br>
<br>
<br>
</div>
<div>On 9/06/2021 4:54 pm, Binh Lam wrote:<br>
</div>
<blockquote type="cite">
<div dir="auto">
<div dir="auto">All,</div>
<div dir="auto"><br>
</div>
For junos.. check the output of
<div dir="auto"><br>
</div>
<div dir="auto">"show ddos-protection protocols statistics
terse"<br>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">will give you some hints what happened..</div>
<div dir="auto">It appears ttl, ndpv6 hit via ix?</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, 9 Jun 2021, 2:48 pm
Luke Iggleden, <<a href="mailto:luke@iggleden.com" target="_blank">luke@iggleden.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Hi All,</p>
<p>I too would like to see what the traffic was that hit our
Junipers with this issue.<br>
</p>
<p>We changed the default arp policer last time a similar
event happened on Megaport, but still this played havoc on
our routing engines. Is there some other traffic we have
to filter to protect our networks from broadcast storms on
this peering fabric?</p>
<p><br>
</p>
<p><br>
</p>
<div>On 9/6/21 2:06 pm, Stavros Patiniotis wrote:<br>
</div>
<blockquote type="cite">
<div>
<p class="MsoNormal"><span>Hi,</span></p>
<p class="MsoNormal"><span> </span></p>
<p class="MsoNormal"><span>Does anyone have a sample
pcap of the erroneous traffic seen from their port
that they would be able to share? </span></p>
<p class="MsoNormal"><span> </span></p>
<p class="MsoNormal"><span> </span></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> AusNOG <a href="mailto:ausnog-bounces@lists.ausnog.net" rel="noreferrer" target="_blank"><ausnog-bounces@lists.ausnog.net></a>
<b>On Behalf Of </b>Dave Browning<br>
<b>Sent:</b> Wednesday, 9 June 2021 1:27 PM<br>
<b>To:</b> <a href="mailto:ausnog@lists.ausnog.net" rel="noreferrer" target="_blank">ausnog@lists.ausnog.net</a><br>
<b>Subject:</b> Re: [AusNOG] Anyone put their
hand up?</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal">The storm came in from
fe80::82e0:1dff:fe27:b440<br>
Which is 80:e0:1d:27:b4:40<br>
Which is 103.26.68.204 in v4 land<br>
Which is AS38858<br>
<br>
:)</p>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">On 9/06/2021 1:38 pm, Edward Um
wrote:</p>
</div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<p class="MsoNormal">Can anyone confirm an outage at
1pm ish today?</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Thanks in advance!</p>
</div>
<p class="MsoNormal">-- </p>
<div>
<p class="MsoNormal">Edward Um<br>
Mobile: +61 449 051 894<br>
<br>
Sent on the run!</p>
</div>
<p class="MsoNormal"><br>
<br>
</p>
<pre>_______________________________________________</pre>
<pre>AusNOG mailing list</pre>
<pre><a href="mailto:AusNOG@lists.ausnog.net" rel="noreferrer" target="_blank">AusNOG@lists.ausnog.net</a></pre>
<pre><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a></pre>
</blockquote>
<p class="MsoNormal"> </p>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
AusNOG mailing list
<a href="mailto:AusNOG@lists.ausnog.net" rel="noreferrer" target="_blank">AusNOG@lists.ausnog.net</a>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
</div>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" rel="noreferrer" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer noreferrer" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</blockquote>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
AusNOG mailing list
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
</div>
</blockquote></div>