Packet filtering on BGP communities

Hi all
I want to achieve the following scenario:
I have a BGP feed that gives me routes with community X.
I have an input ACL on an interface.
I want to be able to say:
if src or dst of packet = any route with community x then drop
I can do this with FBF in junos, can I do this on IOS-XR?

Hi William,
I think you can use technique similar to RTBH :
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6642/prod_white_paper0900aecd80313fac.pdf
by using rpl to set the next-hop to a /32 address statically routed to NULL.
For source address match, you combine this with RPF.
Hope it helps,
Serge.

Similar Messages

System crash attempting to use the packet filtering on Solaris 10, MU7

I have been attempting to port my kernel module to run on Solaris 10, MU7 (from MU6). Some changes to the packet filtering hooks interface requires me to make code changes and linker option changes i.e -Nmisc/neti -Nmisc/hook
I now have my module loading successfully and "hooking" packets. However, I am seeing instability and after processing in the order of 100-200 packets the system crashes. See stack dump beow for details.
Also note that initially my callback hook function is very simple i.e returns 0.
I require assistance on identifying the root cause. The key code fragements are as follows:
int _init()
// allocated a control block using net_instance_alloc
// populated the nin_name, nin_create, nin_destroy, and nin_shutdown fields with valid callback functions
// registered the control block using net_instance_register
static int _attach(dip, cmd)
dev_info_t *dip;
ddi_attach_cmd_t cmd;
// initialised a hook control block using HOOK_INIT
// performed a protocol lookup (using net_protocol_lookup) on the net_id provided by the nin_create function callback
// registered the hook with the net_id protocol using net_hook_register
static int
myipf_hook4_in (hook_event_token_t tok, hook_data_t info, void *arg) {
// simple callback function for test purposes
return 0;
System Stack trace:
Boot device: /virtual-devices@100/channel-devices@200/disk@0:a File and args:
SunOS Release 5.10 Version Generic_139555-08 64-bit
Copyright 1983-2009 Sun Microsystems, Inc. All rights reserved.
Use is subject to license terms.
Hostname: bfs-t5440-03-ldm12
NIS domain name is bfs.nis
Reading ZFS config: done.
bfs-t5440-03-ldm12 console login:
panic[cpu9]/thread=2a100a67ca0: BAD TRAP: type=9 rp=2a100a67630 addr=7b6e8d48 mmu_fsr=0
sched: trap type = 0x9
addr=0x7b6e8d48
pid=0, pc=0x7b6e8d48, sp=0x2a100a66ed1, tstate=0x1606, context=0x0
g1-g7: 1910, 18b0, 2a100a678f0, 60010776b14, 1910, 0, 2a100a67ca0
000002a100a67350 unix:die+9c (9, 2a100a67630, 7b6e8d48, 0, 2a100a67410, 182b400)
%l0-3: 000000000100954c 0000000000000009 0000060020ac1620 00000000010523ac
%l4-7: 00000000018a3c78 0000060020ac1848 000003000481dbe0 00000000010ac400
000002a100a67430 unix:trap+6cc (2a100a67630, 10000, 0, 0, 30004028000, 2a100a67ca0)
%l0-3: 0000000000000000 000000000185b480 0000000000000009 0000000000000000
%l4-7: 0000000000000000 0000000000000000 0000000000001606 0000000000010200
000002a100a67580 unix:ktl0+64 (300014c8e40, 2a100a67890, 600114fb428, 3, 1, 0)
%l0-3: 0000030004028000 0000000000000048 0000000000001606 0000000001021604
%l4-7: 00000000003c0000 0000000000000001 0000000000000000 000002a100a67630
000002a100a676d0 hook:hook_run+7c (30001b039c0, 300014c8e40, 2a100a67890, 60012566ea8, 7b6e8d48, 1)
%l0-3: 0000030001b039c8 00000600117df3c0 0000000001878888 0000000000000000
%l4-7: 0000000000000000 000000000000003c 0000000000000000 0000000000000000
000002a100a67780 ip:ip_input+3b4 (0, 600135ca040, 0, 6001359bc28, 0, 0)
%l0-3: 0000000000000000 0000000000000000 0000000000000000 0000060011562000
%l4-7: 00000000e0000000 0000000000000001 0000000000000000 0000000000000000
000002a100a67910 dls:soft_ring_drain+78 (600135d1f00, 60011dfa940, 2, 2000000, 2, 0)
%l0-3: 0000000000000000 0000000000000000 0000000000000004 0000000000000005
%l4-7: 000006001359bc28 00000600135ca040 000000007be1c238 000000000000fffe
000002a100a679c0 dls:soft_ring_worker+64 (600135d1f00, 0, 2, 600135d1f4c, 0, 2a100a67a8a)
%l0-3: 000002a100a67a88 0000000000000000 000002a10001fca0 000002a10001fca0
%l4-7: 0000000000000002 0000000000000000 0000000000000002 00000000018f1000
syncing file systems... [1] 104 [1] 95 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 [1] 4 done (not all i/o completed)
dumping to /dev/dsk/c0d0s1, offset 644284416, content: kernel
100% done: 118970 pages dumped, compression ratio 10.00, dump succeeded
rebooting...
Resetting...
-eugene
Edited by: emonagh on Aug 25, 2009 1:54 AM
Edited by: emonagh on Aug 25, 2009 1:56 AM

I have checked weblogic download link.
Currently webloigc is only available only for below mentioned platforms:-
1. Windows (32 bit jvm)
2. Linux (32 bit jvm)
3. sun solaris (only SPARC) (32 bit JVM)
There is no generic installer available for weblogic 9.2
Thus what I want is weblogic 9.2 setup for x86 machine.
I have tried to run weblogic 9.2 setup for linux on sun solaris x86.
But it did not run, it also gave error message that some package is missing in /lib/.. folder.....

Packet filtering and traffic shaping during peak h...

I play the online game World of Tanks and an currently exteriancing severe lagg and disconnects, the problem does not appear to be with the game/service provider but with BT, i need to know does BT use "packet filtering" and "traffic shaping" during peak hours and if so why has it suddenly started.
This game use's P2P to keep the latency down for players so have been advised to contact BT and ask them are they limiting these types of connections.
Most games do not use these types of connections, but World of Tanks one does and again,been told BT just don't like them, due to the amount of connections they attempt to forge in order to have a stable latency.
I need to know if this is going to continue as pay to play the game, therefore would have to consider changing my ISP to virgin who dont use "packet filtering" and "traffic shaping" during peak hours .
Quick advice would be appreciated.

It's absolutely horrible. i turned off wifi all other devices and every other open program just to reduce my latency for 120ms to 80ms.
Still suffer from huge packet loss.
It would be absolutely horrible if they have started throttling worldoftanks.eu servers. Phone support is no help all they torld me to do is restart my router
I hope this is fixed soon. There are many posts on the WoT eu official forums and everyone that is effected appears to be a BT customer.
Some have mentioned it could be the damaged undersea cable.
I don't have any problems with torrents being throttled or anything like that. only worldoftanks.eu being throttled.

Systemd- failed to start packet filtering framework

I had installed systemd and also iptables and till recently everything seemed all right. Now I have started getting an error message on bootup that "failed to start packet filtering framework".
There is a suggestion at this site: https://mailman.archlinux.org/pipermail … 30565.html
On running the command "sudo systemctl status iptables", following is the output:
iptables.service - Packet Filtering Framework
Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled)
Active: failed (Result: exit-code) since Tue, 23 Oct 2012 17:30:07 +0000; 12min ago
Process: 200 ExecStart=/usr/sbin/iptables-restore /etc/iptables/iptables.rules (code=exited, status=1/FAILURE)
CGroup: name=systemd:/system/iptables.service
Oct 23 17:30:16 myhost iptables-restore[200]: Can't open /etc/iptables/iptables.rules: No such file or directory
How can I correct this error? Please help.
Last edited by rnarch (2012-10-23 12:17:56)

/etc/iptables/iptables.rules file does not exist, but system was not giving this error message earlier. I was loading iptables rules by following command in /etc/rc.local:
iptables-restore /home/myfw-regular.saved
Probably, I should move myfw-regular.saved file to /etc/iptables/iptables.rules and remove the rc.local line.

Disable packet filtering on BM 3.6

Hi
I have a border manager firewall that I am replacing with a hardware box. I
would still like to use the Border manager as a proxy server and use its
access rules but do not want it to packet filter.
What is the easiest way to acheive this?
thanks
Mike

thanks for that Craig. I am happy with that part of it but what I need to
do is turn the BM box into just a router and turn off all packet
filtering.
What is the best way to do that. Is it via filtcfg or do I need to stop
certain NLMs loading?
thanks
> Make the BMgr server's default gateway the new filtering box.
>
> Filter port 80 and 443 on the new box, and allow those ports only from
> the BMgr server's IP address.
>
> Craig Johnson
> Novell Support Connection SysOp
> *** For a current patch list, tips, handy files and books on
> BorderManager, go to http://www.craigjconsulting.com ***
>
>

Switch having feature of VPN & Packet Filtering

Can someboady help me to know the low end Switch that can be configured for VPN, Packet Filtering etc... within a switch itself?
Suresh

Hi Suresh,
If you are deploying MPLS VPN then you can got for 3750 metro ethernet switches as well.
The configure vpn in cisco switch Catalyst Metro switches are a new line of premier multilayer switches that bring greater intelligence to the metro Ethernet edge, enabling the delivery of more differentiated metro Ethernet services. Featuring hierarchical quality of service (QoS) and traffic shaping, intelligent 802.1Q tunneling, VLAN mapping, Multi-protocol Label Switching (MPLS) and Ethernet over MPLS (EoMPLS) support, and redundant AC or DC power, these switches are ideal for service providers seeking to deliver profitable business services, such as Layer 2, Layer 3, and MPLS VPNs, configure vpn in switch a variety of bandwidths and with different service-level agreements (SLAs). With flexible software options, the Catalyst Metro offers a cost-effective path for meeting current and future service requirements from service providers serving enterprises and commercial businesses.
HTH,Please rate if it does.
-amit singh

Switch supporting VPN & Packet Filtering

Can somebody help me in finding the low end cisco switch that can support VPN as well Packet filtering?
As I need to quote this for one of my customer.
Suresh

Mostly switches that support L3 service should support VPN.It is supported in Cisco 6000 Cat IOS.Search for the keyword "VPN support on switches" in cisco.com.Lot of references available.

802.11 Promiscuous Packet Filters

Hi!
This WDK documentation
topic has the following text:
Note It is only valid for the miniport driver to enable the NDIS_PACKET_TYPE_PROMISCUOUS, NDIS_PACKET_TYPE_802_11_PROMISCUOUS_MGMT, or NDIS_PACKET_TYPE_802_11_PROMISCUOUS_CTRL packet filters if the driver is operating in Network
Monitor (NetMon) or Extensible Access Point (AP) modes.
Is that correct? Why are promiscuous filters valid for ExtAP and not for ExtSTA modes?
Please note that I looked at the Native Wi-Fi Miniport Sample Driver in the Windows 8.1 WDK. I could not see any code that sets the promiscuous filters as described in the WDK. In fact, the function StaSetPacketFilter simply sets the filter settings
without checking to see if any of the promiscuous filter bits are set.
What am I missing?
Thanks!

> Is that correct?
No one denied this, so, very probably, correct.
> What am I missing?
Sample drivers are not 100% production quality. You can request to fix the sample to match the documentation.
Happy new year!
-- pa

Suggestion for packet filtering

i m trying to use the java to implement the packet filtering function..i would like to know which package i suppose to use? java.net is not enought for packet filtering rite? another one thing jar file is suitable to use the agent or not? or use the agent in exe and call the main function in java? can i have some suggestion? thanks

is planning the fault? or people who discouraging me bear the fault? without planning what u can do? consider please! if u wanna know something but people laugh at u because u don't know, how will u feel? u have posted lots in here. are all the messages are discouraging the people who don't know? stop thinking urself as GREAT ok? NO BODY IS PERFECT IN EVERY THING. stick on it.
why don't u just help me out by showing the way? stop flaunting around! no body want like this kind of character here.

Packet filters support supernets?

I trying to get BM3.8 setup to allow packet filter exceptions for smtp
from multiple "networks" which are supernets (email goes thru'
MessageLabs)
I read somewhere that there is a bug or 3.8 does not support supernetting.
The trace shows the inbound packets being discarded even though they are
in the supernet range.
Any ideas - work arounds.

Given that there are literally hundreds of individuals subnets - I will just recommend that the client purchase a real firewall. :(
>>> Caterina Luppi<[email protected]> 23/06/2006 03:52:54 >>>
Jeff,
> I trying to get BM3.8 setup to allow packet filter exceptions for smtp
> from multiple "networks" which are supernets (email goes thru'
> MessageLabs)
>
> I read somewhere that there is a bug or 3.8 does not support supernetting..
Correct - packet filters don't support supernetting.
> Any ideas - work arounds.
no workarounds, I'm afraid. You'll have to duplicate the filters for
each network you need to open.
Cat
NSC Volunteer Sysop

Bordermanager 3.8 sp5 ir packet filtering problems

Hello,
On a freshly installed netware 6.5 sp6 with post fixes server, i have some problems with the packet filters i had never before.
the strange thing that happens is that when i load my filters some services configured on the private network card get blocked to. Like DHCP (does not want to bind)/NDPS manager/Groupwise poa
The rest of the traffic is going correctly thru my exceptions.
i already checked the tcpip.cfg for duplicate entry's and checked my servers configured services and ip numbers on NORM.
already tried to clear all filters and delete the filters.cfg file and run a brdcfg.
Best regards,
Niels van der Greef

Originally Posted by Craig Johnson
What is configured in FILTCFG for filtering (not filter exceptions?)
Does it look like tip #13 at the URL below?
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to Craig Johnson Consulting - BorderManager, NetWare, and More ***
Yes the filters are configured that way.

BGP on A9K: Filtering prefixes using Communities on iBGP

Hello,
We are trying to filter some prefixes to a iBGP connection but it doesn't work properly:
The rpl is like this:
community-set MID
15525:8657
end-set
route-policy Deny_Community_MID
if community matches-any MID then
    drop
else
    pass
endif
end-policy
This rpl only removes the community from the prefix, and the prefix always arrive on the iBGP neighbor, which it not what we intend to do ! What we intend to do is to filter out the prefix ...
On our research we find this which is absolutely different from the IOS behaviour ...
BGP community and extended-community filtering cannot be configured for iBGP neighbors. Communities and extended-communities are always sent to iBGP neighbors
on
http://www.cisco.com/en/US/partner/docs/routers/asr9000/software/asr9k_r4.0/routing/configuration/guide/rc40asr9k_chapter1.html#task_1211424
Is this true or are we seeing this the wrong way?
Thank you!

Done! But i have several more examples on the poor and buggy IOSXR documentation .. :
Command Reference A9K 4.0, BGP Chapter:
                The commands “additional-paths” should have a brief explanation stating that they belong the PIC Edge Framework .. but nothing .. No usage guidelines
Command Reference A9K 4.0, IS-IS Chapter:
The command “ipfrr” is deprecated and replaced by “fast-reroute” but still appears on documentation ..
Configuration Guide A9K 4.0, Routing Chapter:
                There is no reference to PIC anywhere .. only a couple of meaningless words

Get BGP communities via SNMP

Hello all,
I'm trying to monitor BGP sessions, and I need to distinguish where I am getting routes from.
There are multiple sites advertising routes to our network and we use communities to identify them as a code number.
I'm able to get the received routes from a peer but not the community that the route comes with.
Is there a way to do that using SNMP?

There is no SNMP message that can be used to define a upper threshold for the connections that can be used to check the connection status. You can use a script that can automatically login and check the connections on your device or you can use some network management software for this.

DNS Packet Filtering Within BM3.9

Hi
I hope you can help - now i think i know the answer to this (No!), but i really need some functionality within ZCM10 working ok for patches. See :- here
But as we use BM3.9 which does not allow DNS filtering am i to understand its not possible to follow this particular Novell TID with the only Novell product that does this job!.
Or am i being dimm.
Cheers
Jules

Hi,
Jules2003 wrote:
>
> Hi
>
> The TID does not mention it but it is implied here :-
>
> # From the ZCM server where patch download has been enabled, ensure
> that the firewall/proxy is open to ping, traceroute, and a browser
> response on http, https from:
>
> 1. http://cdn.patchlink.com/novell
> 2. http://content.patchlink.com/novell
> 3. https://novell.patchlink.com/
> 4. http://novell.cdn.lumension.com/novell/baretta.xml
Yes, and? There's no relation to DNS here, right?
> How is this possible through bordermanager without proxy
> authentication, our ZCM server is linux, so no client trust
> authentication to use the proxy rules.
Then you either allow by source IP of your ZCM server (you can do that
throug hfiltering or in proxy authentication rules). Or you allow
unauthenticated access to the targets by their DNS name (proxy access
rules only).
> So then im guessing we need to go
> down to the filters which in our case do not allow DNS based filtering
> which aside from the above has been a problem with windows updates
> also.
Windows updates are an entirely different matter. I strongly suggest a
WSUS server, and again allow that to go through the proxy based on it's
IP. Automatic Windows updates using the proxy have never worked through
Bordermanagers Proxy. I know there are some odd reports that it works,
but that doesn't match my experience.
> So the question im asking is can i use DNS based filtering as that TID
> implies that i need it.
No you can't, and no, that TID does not imply that. You *can* of course
configure the necessary access rules by target DNS name or even allow
filter exceptions based on source IP of your ZCM servers.
CU,
Massimo Rosen
Novell Product Support Forum Sysop
No emails please!
http://www.cfc-it.de

[Solved] Packet filtering.

Hi,
I am looking for a convenient way to filter packets from expression in form of \x00 (for exemple) I took a look at tcpdump but couldn't find a way to do so with it and it would actually be better if I could do so without using WireShark (for memory consumption). This is for a bash script and any hint would help, should I consider coding a packet filter in bash and then filter packets from my hexadecimal pattern ? Or is there another tool I could use to do do ?
Thank's a lot
Last edited by sugartest (2014-07-16 12:10:25)

You can do that with iptables using the 'string' module.
man iptables-extentions wrote:
string
This modules matches a given string by using some pattern matching strategy. It requires a linux kernel >= 2.6.14.
--algo {bm|kmp}
Select the pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
--from offset
Set the offset from which it starts looking for any matching. If not passed, default is 0.
--to offset
Set the offset up to which should be scanned. That is, byte offset-1 (counting from 0) is the last one that is scanned. If not passed, default is the packet size.
[!] --string pattern
Matches the given pattern.
[!] --hex-string pattern
Matches the given pattern in hex notation.
Examples:
# The string pattern can be used for simple text characters.
iptables -A INPUT -p tcp --dport 80 -m string --algo bm --string 'GET /index.html' -j LOG
# The hex string pattern can be used for non-printable characters, like |0D 0A| or |0D0A|.
iptables -p udp --dport 53 -m string --algo bm --from 40 --to 57 --hex-string '|03|www|09|netfilter|03|org|00|'

Packet filtering on BGP communities

Similar Messages

Maybe you are looking for