1. Home
  2. Cisco Systems
  3. Routing 127.0.0.1!? strange errors

Routing 127.0.0.1!? strange errors

Maybe somebody can shed some light on this. I have a 3845 router, with interfaces as follows:

10.35.33.0/24 -> fast 1/14 10.35.49.0/24 -> fast 1/13

I am seeing a lot of rejects and errors. It seems that we are trying to route packets from the 127.0.0.1 network (RSTs to port 80 connections), but I'm stumped as to how those packets could even leave the requesting pc. Any ideas/pointers?

Jan 24 14:40:41.421: IP: s=127.0.0.1 (FastEthernet1/0), d=10.35.33.167 (FastEthernet1/14), g=10.35.33.167, len 40, forward Jan 24 14:40:41.421: TCP src=80, dst=1936, seq=0, ack=707002369, win=0 ACK RST Jan 24 14:40:41.421: IP: s=127.0.0.1 (FastEthernet1/0), d=10.35.33.167 (FastEthernet1/14), len 40, encapsulation failed Jan 24 14:40:41.421: TCP src=80, dst=1936, seq=0, ack=707002369, win=0 ACK RST Jan 24 14:40:42.361: IP: tableid=0, s=127.0.0.1 (FastEthernet1/0), d=10.35.49.109 (FastEthernet1/13), routed via RIB Jan 24 14:40:42.361: %SEC-6-IPACCESSLOGP: list filtrado-outbound-ota denied tcp 127.0.0.1(80) -> 10.35.49.109(1001), 1 packet Jan 24 14:40:42.361: IP: s=127.0.0.1 (FastEthernet1/0), d=10.35.49.109 (FastEthernet1/13), len 40, access denied Jan 24 14:40:42.361: TCP src=80, dst=1001, seq=0, ack=1821245441, win=0 ACK RST

Reply to
Sag
Loading thread data ...

Maybe a PC with a missing entry in its host file ?

Reply to
turnip

A missing host entry file would result in a DNS query not a packet being sent out the interface. Get the MAC address of the 127.0.0.1 entry with a "show arp" and the go to then track the MAC address to the correct port on the switch with a "show mac-address-table" and then trace the cable to the PC. You might find another IP address with the same MAC in the arp table, which would be the real IP of the PC. I suspect you have a PC with a virus on it.

Reply to
Thrill5

Virus seems reasonable.

127.0.0.1 should never appear as a real address in packets. This suggests a misbehaving device. Tracking it down by mac though may be tricky since I doubt that the sending device will respond to arp on that address. If there are no arp entries you will have to find another way to track the source.

does "deb ip pack det" show the mac addresses? I forget.

Even then you will only see the mac for the next hop and will need to repeat the exercise back through the network.

Reply to
Bod43

Bingo. A "sh arp | inc 127.0.0.1" does not show anything.

It'a a remote location (>160km), I guess I'll have to head there with a laptop and wireshark.

Nop.

Thanks to everybody for the input and suggestions!

Reply to
Sag

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.