<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"LT_Bold\,Arial";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
page-break-after:avoid;
font-size:14.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
h1
{mso-style-priority:9;
mso-style-link:"Título 1 Car";
margin-top:6.0pt;
margin-right:0cm;
margin-bottom:6.0pt;
margin-left:0cm;
page-break-after:avoid;
font-size:16.0pt;
font-family:"Arial",sans-serif;
color:#002060;
letter-spacing:1.0pt;
mso-fareast-language:EN-US;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoNoSpacing, li.MsoNoSpacing, div.MsoNoSpacing
{mso-style-priority:1;
margin:0cm;
font-size:9.0pt;
font-family:Consolas;
mso-fareast-language:EN-US;}
span.Ttulo1Car
{mso-style-name:"Título 1 Car";
mso-style-priority:9;
mso-style-link:"Título 1";
font-family:"Arial",sans-serif;
color:#002060;
letter-spacing:1.0pt;
font-weight:bold;}
span.EstiloCorreo26
{mso-style-type:personal-compose;
font-family:"Arial",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ES" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Estimados miembros, por favor podrían pedir a su personal técnico si ven logs en su router conectado al IXP , parecidos a estos?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Mi router me avisa de estos ataques de ARP por el puerto que tengo conectado al IXP y lo estamos investigando.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Gracias.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Sep 22 2021 18:21:29-03:00 SW1POP20-L3 %%01SECE/4/ARPMISS(l)[435]:Attack occurred.(AttackType=Arp Miss Attack, SourceInterface=XGigabitEthernet0/0/4, SourceIP=186.148.170.253, AttackPackets=43 packets per second)<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Sep 22 2021 18:18:13-03:00 SW1POP20-L3 %%01SECE/4/ARPMISS(l)[436]:Attack occurred.(AttackType=Arp Miss Attack, SourceInterface=XGigabitEthernet0/0/4, SourceIP=20.199.105.48, AttackPackets=39 packets per second)<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Sep 22 2021 18:11:28-03:00 SW1POP20-L3 %%01SECE/4/ARPMISS(l)[437]:Attack occurred.(AttackType=Arp Miss Attack, SourceInterface=XGigabitEthernet0/0/4, SourceIP=47.98.232.243, AttackPackets=39 packets per second)<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Sep 22 2021 18:10:05-03:00 SW1POP20-L3 %%01SECE/4/ARPMISS(l)[438]:Attack occurred.(AttackType=Arp Miss Attack, SourceInterface=XGigabitEthernet0/0/4, SourceIP=186.148.164.42, AttackPackets=50 packets per second)<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="page-break-after:auto"><b><span style="font-size:11.0pt;mso-fareast-language:ES">De:</span></b><span style="font-size:11.0pt;mso-fareast-language:ES"> Julio Policarpo <<a href="mailto:noc.julio@cabase.org.ar">noc.julio@cabase.org.ar</a>>
<br>
<b>Enviado el:</b> lunes, 20 de septiembre de 2021 10:13<br>
<b>Para:</b> Fernando Soto <<a href="mailto:soto.fernando@bbt.com.ar">soto.fernando@bbt.com.ar</a>>; 'NOC Cabase' <<a href="mailto:noc@cabase.org.ar">noc@cabase.org.ar</a>><br>
<b>CC:</b> Teleco <<a href="mailto:teleco@bbt.com.ar">teleco@bbt.com.ar</a>><br>
<b>Asunto:</b> RE: Arp Miss Attack<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Estimados, se generó el ticket número TT4144 para dicha solicitud, los mantendremos informados<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Saludos cordiales.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="page-break-after:auto"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="page-break-after:auto"><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:ES"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="border:none;border-top:solid #009FDA 1.5pt;padding:3.75pt 7.5pt 0cm 7.5pt">
<p class="MsoNormal" style="mso-line-height-alt:12.0pt;page-break-after:auto"><a href="https://www.cabase.org.ar/" target="_blank"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:blue;mso-fareast-language:ES;text-decoration:none"><img border="0" width="196" height="59" style="width:2.0416in;height:.6145in" id="Imagen_x0020_6" src="cid:image001.png@01D7AE0C.438773B0"></span></a><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D;mso-fareast-language:ES"><br>
<br>
</span><b><span style="font-size:12.0pt;color:#1F497D;mso-fareast-language:ES">Julio Policarpo
</span></b><span style="font-size:12.0pt;color:#1F497D;mso-fareast-language:ES">|
</span><span style="font-size:11.0pt;color:#1F497D;mso-fareast-language:ES">NOC CABASE</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D;mso-fareast-language:ES">
<br>
<a href="https://goo.gl/maps/bpkHRVuKDzj" target="_blank"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black;text-decoration:none">Suipacha 128 - 3 "F"</span></a>
</span><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black;mso-fareast-language:ES">- Tel: (+5411) 5263-7456</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D;mso-fareast-language:ES">
<br>
<a href="https://www.cabase.org.ar/" target="_blank"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif;color:#009FDA;text-decoration:none">www.cabase.org.ar</span></a>
<o:p></o:p></span></p>
</td>
</tr>
<tr>
<td style="padding:3.75pt 7.5pt 0cm 7.5pt">
<p class="MsoNormal" style="line-height:105%;page-break-after:auto"><a href="https://www.linkedin.com/company/cabase" target="_blank"><span style="font-size:12.0pt;line-height:105%;font-family:"Times New Roman",serif;color:blue;mso-fareast-language:ES;text-decoration:none"><img border="0" width="30" height="30" style="width:.3125in;height:.3125in" id="Imagen_x0020_2" src="cid:image002.png@01D7AE0C.438773B0"></span></a><a href="https://www.facebook.com/CabaseAr/" target="_blank"><span style="font-size:12.0pt;line-height:105%;font-family:"Times New Roman",serif;color:blue;mso-fareast-language:ES;text-decoration:none"><img border="0" width="30" height="30" style="width:.3125in;height:.3125in" id="Imagen_x0020_3" src="cid:image003.png@01D7AE0C.438773B0"></span></a><a href="https://twitter.com/CabaseAr" target="_blank"><span style="font-size:12.0pt;line-height:105%;font-family:"Times New Roman",serif;color:blue;mso-fareast-language:ES;text-decoration:none"><img border="0" width="30" height="30" style="width:.3125in;height:.3125in" id="Imagen_x0020_4" src="cid:image004.png@01D7AE0C.438773B0"></span></a><a href="https://www.youtube.com/channel/UCFv0lo1ybgvDesRoFr1ZTTw" target="_blank"><span style="font-size:12.0pt;line-height:105%;font-family:"Times New Roman",serif;color:blue;mso-fareast-language:ES;text-decoration:none"><img border="0" width="30" height="30" style="width:.3125in;height:.3125in" id="Imagen_x0020_5" src="cid:image005.png@01D7AE0C.438773B0"></span></a><span style="font-size:12.0pt;line-height:105%;font-family:"Times New Roman",serif;color:#1F497D;mso-fareast-language:ES"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="page-break-after:auto"><span style="font-size:11.0pt;mso-fareast-language:ES"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="page-break-after:auto"><b><span style="font-size:11.0pt;mso-fareast-language:ES">De:</span></b><span style="font-size:11.0pt;mso-fareast-language:ES"> Fernando Soto <<a href="mailto:soto.fernando@bbt.com.ar">soto.fernando@bbt.com.ar</a>>
<br>
<b>Enviado el:</b> lunes, 20 de septiembre de 2021 10:01<br>
<b>Para:</b> NOC Cabase <<a href="mailto:noc@cabase.org.ar">noc@cabase.org.ar</a>><br>
<b>CC:</b> Teleco <<a href="mailto:teleco@bbt.com.ar">teleco@bbt.com.ar</a>><br>
<b>Asunto:</b> Arp Miss Attack<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Buenos día Noc<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Les quería pedir por favor si me pueden ayudar con este log que veo en nuestro switch Huawei 6720 con el que hago bgp contra el IXP<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Arial",sans-serif">arp Miss Attack desde distintas ips<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Me llega solo de la interfaz que tengo contra el IXP (xgiga 0/0/4)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">y llegan todos los días.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">No me queda claro el concepto del ataque:<o:p></o:p></span></p>
<div style="border:none;border-bottom:solid #333333 1.0pt;padding:0cm 0cm 14.0pt 0cm">
<h1 style="mso-margin-top-alt:18.75pt;margin-right:0cm;margin-bottom:7.5pt;margin-left:0cm;background:white">
<span lang="EN-US" style="font-size:22.0pt;font-family:"LT_Bold\,Arial";color:#333333">What Is ARP Miss?<o:p></o:p></span></h1>
</div>
<p style="mso-margin-top-alt:1.2pt;margin-right:0cm;margin-bottom:6.0pt;margin-left:0cm;background:white;box-sizing: border-box;-webkit-tap-highlight-color: transparent;margin-block: 0px;margin-inline: 0px;overflow-wrap: break-word">
<span lang="EN-US" style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#494949">The device sends an ARP Miss message when the routing table contains the routing entry that maps the destination IP address of an IP packet, but does not contain the ARP
entry that maps the next hop of the routing entry.<o:p></o:p></span></p>
<p style="margin:0cm;background:white;box-sizing: border-box;-webkit-tap-highlight-color: transparent;margin-block: 0px;margin-inline: 0px;overflow-wrap: break-word">
<span lang="EN-US" style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#494949">The IP packet that triggers the ARP Miss message is sent to the CPU for processing. The device generates and delivers a temporary ARP entry based on the ARP Miss message,
and sends an ARP Request packet to the destination network.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:1.2pt;margin-right:0cm;margin-bottom:6.0pt;margin-left:0cm;background:white;box-sizing: border-box;-webkit-tap-highlight-color: transparent;margin-block: 0px;margin-inline: 0px;overflow-wrap: break-word">
<span lang="EN-US" style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#494949">If a host sends a large number of IP packets with unresolvable destination IP addresses (the device has a route to the destination IP address of a packet but has no ARP
entry matching the next hop of the route) to a device, the device sends a large number of ARP Miss messages and many ARP Request packets to the destination network, consuming considerable CPU and bandwidth resources.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><SW1POP20-L3>display ip routing-table 186.148.164.42<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Route Flags: R - relay, D - download to fib<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">------------------------------------------------------------------------------<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Routing Table : Public<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Summary Count : 1<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Destination/Mask Proto Pre Cost Flags NextHop Interface<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"> 0.0.0.0/0 EBGP 255 0 RD 10.169.250.161 Vlanif101<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><SW1POP20-L3><o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><SW1POP20-L3>display ip routing-table 199.195.254.38<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Route Flags: R - relay, D - download to fib<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">------------------------------------------------------------------------------<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Routing Table : Public<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Summary Count : 1<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US">Destination/Mask Proto Pre Cost Flags NextHop Interface<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"> 0.0.0.0/0 EBGP 255 0 RD 10.169.250.161 Vlanif101<o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><SW1POP20-L3><o:p></o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNoSpacing"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="1466" height="762" style="width:15.2708in;height:7.9375in" id="Imagen_x0020_1" src="cid:image007.jpg@01D7AE0C.43A92C80"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</div>
</body>
</html>