[AusNOG] SPAM-LOW: Pipe peering issue - Equinix

[Sean K. Finn]

When a CAM Table is maxed-out a switch becomes a full-duplex hub. (Cool hey).

If it doesn’t know which mac address to send the traffic to, it sends it EVERYWHERE.

If the traffic is deliberately being injected into a port knowing that the mac address doesn’t exist on the peering fabric, EVERYONE gets it, even if the CAM table isn’t full.

I’m not on PIPE-IX-SYD, (Only on Equinix-SYD, O Hai) but I can imagine that..


There’s a customer connected to the IX who’s own network has become a hub so they are smashing L2 traffic into the IX not on purpose.

At least I’d hope that’s the case, I wouldn’t imagine anyone would deliberately sabotage the IX.

If someone can sniff the packets you may be able to get the MAC address, then do an Arping on all of the IX IP’s and see which mac addresses match the IP’s in question, or look at your routers ARP table for a corresponding MAC address to get the offending networks PEER-IP. (Or look on the graphs and see who is inverse to everyone else).


Who has more peers, by the way? Equinix-SYD or PIPE-SYD?

S.

From: ausnog-bounces at lists.ausnog.net [mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of ZoneNetworks - Joel
Sent: Sunday, November 13, 2011 9:35 AM
To: Skeeve Stevens
Cc: ausnog at ausnog.net
Subject: Re: [AusNOG] SPAM-LOW: Pipe peering issue - Equinix

To my knowledge it's a hardware/firmware issue not traffic related ...though looking at the graphs it seems like traffic/flood which is misleading

If more customers gave them a hard time it might get fixed sooner, we were told (in august) they had a long term fix in plan but no ETA when it will be done
Not something you would hear from the "old pipe"

Joel
Sent from my iPad

On 13/11/2011, at 10:06 AM, Skeeve Stevens <Skeeve at eintellego.net<mailto:Skeeve at eintellego.net>> wrote:
Do we know where the traffic is coming from?

…Skeeve

--

Skeeve Stevens, CEO - eintellego Pty Ltd

skeeve at eintellego.net<mailto:skeeve at eintellego.net> ; www.eintellego.net<http://www.eintellego.net>

Phone: 1300 753 383 ; Fax: (+612) 8572 9954

Cell +61 (0)414 753 383 ; skype://skeeve

facebook.com/eintellego<http://facebook.com/eintellego>

twitter.com/networkceoau<http://twitter.com/networkceoau> ; www.linkedin.com/in/skeeve<http://www.linkedin.com/in/skeeve>

PO Box 7726, Baulkham Hills, NSW 1755 Australia


--
eintellego - The Experts Who The Experts Call
Juniper - HP Networking - Cisco - Brocade

On 13/11/11 10:04 AM, "Jared Hirst" <jared.hirst at serversaustralia.com.au<mailto:jared.hirst at serversaustralia.com.au>> wrote:

Yeah every few weeks it happens is what I mean, they start sending
hundreds of mbits of useless broadcast traffic to all customers in
Equinix. It's getting frustrating and annoying as it always seems to
happen at 2:00on a Saturday morning :(

Kindest Regards,
Jared Hirst

Servers Australia Pty Ltd

Phone: 02 4307 4200
Fax: 02 4307 4201
Web: http://www.serversaustralia.com.au

On 13/11/2011, at 4:26 AM, "joel at zonenetworks.com.au<mailto:joel at zonenetworks.com.au>"
<joel at zonenetworks.com.au<mailto:joel at zonenetworks.com.au>> wrote:

It's been happening for months now not few weeks

Last time we were told they need to fix switch/router but they can't do it for some reason

Sent from my HTC

----- Reply message -----
From: "Jared Hirst" <jared.hirst at serversaustralia.com.au<mailto:jared.hirst at serversaustralia.com.au>>
To: "ausnog at ausnog.net<mailto:ausnog at ausnog.net>" <ausnog at ausnog.net<mailto:ausnog at ausnog.net>>
Subject: SPAM-LOW:  [AusNOG] Pipe peering issue - Equinix
Date: Sun, Nov 13, 2011 3:30 am


Guys,

Just as an FYI there appears to be some form of broadcast storm on the
pipe peering fabric in Equinix Sydney, looks to be affecting a few
people and filling links from the looks of their online graphs.

We have had to shut our pipe peering down until they resolve it, which
is my next question... Do pipe have a 24/7 NOC still? I called over 30
minutes ago and went to a messaging service but have not had a call
back, have also created a ticket with no response.

So if anyone is wondering why their pipe link is full, this is why.
Appears to be happening every few weeks in Equinix lately.

Kindest Regards,
Jared Hirst

Servers Australia Pty Ltd

Phone: 02 4307 4200
Fax: 02 4307 4201
Web: http://www.serversaustralia.com.au
_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>
http://lists.ausnog.net/mailman/listinfo/ausnog

_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>
http://lists.ausnog.net/mailman/listinfo/ausnog

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20111114/78682c0a/attachment.html>