Experimental Physics and
Industrial Control System

Andrew Johnson <[email protected]> · Mon, 16 Jul 2018 12:07:40 -0500

Hi Dirk,

On 07/16/2018 02:42 AM, Dirk Zimoch via Tech-talk wrote:
> We at PSI hat problems with new Cisco switches (I don't know the model)
> dropping CA directed broadcasts (i.e. broadcasts into another subnet,
> such as 172.17.2.255 172.17.3.255) and even blocking them for a while
> when the rate went over a certain limit (e.g. when a huge UI starts up).
> I think that was supposed to be a counter measure against denial of
> service attacks. It took over a year of discussion with Cisco to get a fix.

You managed to get Cisco to support the conversion of a UDP packet sent
to a subnet's broadcast address into a real broadcast packet on that
subnet? I'm impressed! Our older HP switches used to allow this but IT
replaced them several years ago (we weren't relying on this behaviour,
which does have some fairly obvious DoS attack possibilities).

For the record, can you find out if that Cisco solution is specific to a
particular model or family of switches, or if they made it generic?

- Andrew

-- 
Arguing for surveillance because you have nothing to hide is no
different than making the claim, "I don't care about freedom of
speech because I have nothing to say." -- Edward Snowdon

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System