Pontos de acesso HP enviando pacotes multicast de IPs que não são seus

Eu não sou nosso cara de rede normal ... Acabei de ser convocado para ajudar com esse problema; portanto, tenha paciência comigo.

Temos uma rede bastante grande (~ 4.000 dispositivos?) Composta principalmente por equipamentos HP Procurve. De tempos em tempos, nas últimas semanas, temos recebido tempestades de transmissão que praticamente impedem o envio de todo o tráfego pela rede. Eu configurei o Wireshark para fazer despejos de 5 MB e peguei um pouco disso em flagrante hoje de manhã.

Você pode baixar a captura de pacotes . A diversão começou no pacote # 23968. Um pacote NBNS aparentemente malformado é repetido várias vezes. No entanto, não é apenas um loop direto. Os endereços IP de origem (143.226.8.185) e de destino (143.226.44.79) permanecem os mesmos, mas o endereço MAC de origem é alterado. O primeiro pacote parece vir de algum dispositivo insignificante na rede e é enviado para um endereço multicast 01: 00: 5e: 7f: ff: fa. Todos os pacotes seguintes vêm dos endereços MAC dos nossos pontos de acesso sem fio HP e são enviados para um endereço multicast diferente, 01: 00: 5e: 62: 2c: 4f.

Aqui está o primeiro pacote:

No.     Time        Source                Destination           Protocol Info
  23968 122.229240  143.226.8.185         143.226.44.79         NBNS     Unknown operation (10) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding)[Malformed Packet]

Frame 23968 (1038 bytes on wire, 1038 bytes captured)
    Arrival Time: Sep 15, 2010 08:32:44.329966000
    [Time delta from previous captured frame: 0.004744000 seconds]
    [Time delta from previous displayed frame: 0.004744000 seconds]
    [Time since reference or first frame: 122.229240000 seconds]
    Frame Number: 23968
    Frame Length: 1038 bytes
    Capture Length: 1038 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:nbns]
    [Coloring Rule Name: SMB]
    [Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios]
Ethernet II, Src: IntelCor_d2:5e:6b (00:1f:3b:d2:5e:6b), Dst: IPv4mcast_7f:ff:fa (01:00:5e:7f:ff:fa)
    Destination: IPv4mcast_7f:ff:fa (01:00:5e:7f:ff:fa)
        Address: IPv4mcast_7f:ff:fa (01:00:5e:7f:ff:fa)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: IntelCor_d2:5e:6b (00:1f:3b:d2:5e:6b)
        Address: IntelCor_d2:5e:6b (00:1f:3b:d2:5e:6b)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 7773643D22687474703A2F2F736368656D61732E786D6C73...
    Frame check sequence: 0x6f70653e [incorrect, should be 0x30019938]
Internet Protocol, Src: 143.226.8.185 (143.226.8.185), Dst: 143.226.44.79 (143.226.44.79)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 203
    Identification: 0x00d0 (208)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0xe485 [correct]
        [Good: True]
        [Bad : False]
    Source: 143.226.8.185 (143.226.8.185)
    Destination: 143.226.44.79 (143.226.44.79)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
    Source port: netbios-ns (137)
    Destination port: netbios-ns (137)
    Length: 183
    Checksum: 0x01db [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
NetBIOS Name Service
    Transaction ID: 0x4d2d
    Flags: 0x5345 (Unknown operation)
        0... .... .... .... = Response: Message is a query
        .101 0... .... .... = Opcode: Unknown (10)
        .... ..1. .... .... = Truncated: Message is truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... ...0 .... = Broadcast: Not a broadcast packet
    Questions: 16722
    Answer RRs: 17224
    Authority RRs: 8234
    Additional RRs: 8264
    Queries
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (12081)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (12081)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (11631)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (11631)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (25701)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (25701)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (25914)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (25914)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (25970)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (25970)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (18273)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (18273)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (24953)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (24953)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (26979)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (26979)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (3338)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (3338)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (14882)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (14882)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (28730)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (28730)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (25455)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (25455)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (8717)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (8717)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (28513)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (28513)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (29287)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (29287)
[Malformed Packet: NBNS]
    [Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]
        [Message: Malformed Packet (Exception occurred)]
        [Severity level: Error]
        [Group: Malformed]

Aqui está o próximo pacote:

No.     Time        Source                Destination           Protocol Info
  23969 122.229836  143.226.8.185         143.226.44.79         NBNS     Unknown operation (10) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding) unknown Illegal NetBIOS name (1st character not between A and Z in first-level encoding)[Malformed Packet]

Frame 23969 (217 bytes on wire, 217 bytes captured)
    Arrival Time: Sep 15, 2010 08:32:44.330562000
    [Time delta from previous captured frame: 0.000596000 seconds]
    [Time delta from previous displayed frame: 0.000596000 seconds]
    [Time since reference or first frame: 122.229836000 seconds]
    Frame Number: 23969
    Frame Length: 217 bytes
    Capture Length: 217 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:nbns]
    [Coloring Rule Name: SMB]
    [Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios]
Ethernet II, Src: HewlettP_05:de:da (00:17:a4:05:de:da), Dst: IPv4mcast_62:2c:4f (01:00:5e:62:2c:4f)
    Destination: IPv4mcast_62:2c:4f (01:00:5e:62:2c:4f)
        Address: IPv4mcast_62:2c:4f (01:00:5e:62:2c:4f)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: HewlettP_05:de:da (00:17:a4:05:de:da)
        Address: HewlettP_05:de:da (00:17:a4:05:de:da)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: 143.226.8.185 (143.226.8.185), Dst: 143.226.44.79 (143.226.44.79)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 203
    Identification: 0x00d0 (208)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 127
    Protocol: UDP (0x11)
    Header checksum: 0xe585 [correct]
        [Good: True]
        [Bad : False]
    Source: 143.226.8.185 (143.226.8.185)
    Destination: 143.226.44.79 (143.226.44.79)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
    Source port: netbios-ns (137)
    Destination port: netbios-ns (137)
    Length: 183
    Checksum: 0x01db [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
NetBIOS Name Service
    Transaction ID: 0x4d2d
    Flags: 0x5345 (Unknown operation)
        0... .... .... .... = Response: Message is a query
        .101 0... .... .... = Opcode: Unknown (10)
        .... ..1. .... .... = Truncated: Message is truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... ...0 .... = Broadcast: Not a broadcast packet
    Questions: 16722
    Answer RRs: 17224
    Authority RRs: 8234
    Additional RRs: 8264
    Queries
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (12081)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (12081)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (11631)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (11631)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (25701)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (25701)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (25914)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (25914)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (25970)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (25970)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (18273)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (18273)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (24953)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (24953)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (26979)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (26979)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (3338)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (3338)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (14882)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (14882)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (28730)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (28730)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (25455)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (25455)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (8717)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (8717)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (28513)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (28513)
        Illegal NetBIOS name (1st character not between A and Z in first-level encoding): type unknown, class Unknown (29287)
            Name: Illegal NetBIOS name (1st character not between A and Z in first-level encoding)
            Type: unknown
            Class: Unknown (29287)
[Malformed Packet: NBNS]
    [Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]
        [Message: Malformed Packet (Exception occurred)]
        [Severity level: Error]
        [Group: Malformed]

Louco, não? Se você examinar a captura de pacotes, verá muito desse pacote repetido após esse ponto. Ele continua e continua depois disso, em vários outros arquivos.

Se isso fosse um loop, por que apenas nossos APs enviariam esse pacote? Esses APs estão espalhados por todo o campus.

Um pouco mais de informação sobre nossa rede ... É tudo plano. A Ethernet direta funciona com tudo, e temos um bloco de IPs de classe B. Sem sub-redes. Há um modelador de pacotes, firewall e roteador entre nossa rede e nossa conexão WAN.

Por fim, se você vir esta postagem e lhe parecer familiar, é porque eu publiquei um problema semelhante no passado que ainda precisamos resolver, mas ainda não o vi recentemente. Isso pode ser encontrado nos switches HP que enviam solicitações de ping de transmissão múltipla .

Muito obrigado pelo seu tempo!

Edit: O pacote 23968 é confirmado como o gatilho dessa tempestade multicast. Repeti esse pacote em nossa rede e o iniciei novamente.

Editar / Atualizar:Fazendo mais algumas experiências. Peguei um dos nossos pontos de acesso HP e o conectei diretamente ao meu PC. Nada mais anexado ao segmento. Se eu reproduzir o pacote inicial que estava causando os problemas ao AP, o AP responde uma vez. Se eu reproduzir novamente a resposta do ponto de acesso, ele responderá novamente. Cada vez que faz isso, o TTL é reduzido. O que está acontecendo aqui é que os pontos de acesso na rede ouvem inicialmente o pacote multicast quebrado do host e respondem a ele através do multicast. Cada ponto de acesso ouve essas respostas de todos os outros pontos de acesso e responde a eles. Cada AP ouve todas as respostas às respostas e responde a elas. Felizmente, diminui o TTL a cada vez, para que a tempestade desapareça assim que o TTL atinge 0 e o pacote é eliminado. Agora tudo o que preciso fazer é descobrir como parar esse comportamento!

O ponto de acesso que tenho diante de mim é um HP Procruve 420 J8130B.

Editar (RESOLVIDO!): Depois de tentar aparentemente todas as definições de configuração no AP, ainda não consegui impedi-lo de retransmitir esses pacotes multicast. Descobri que não estávamos no firmware mais recente, então tentei atualizar, mas o problema persistiu. Então tentei fazer o downgrade para a versão 2.1.7 de 29 de novembro de 2006. Sem problemas com este firmware! Os AP que executam 2.1.7 não retransmitem o pacote !!! Ainda estou esperando para descobrir como os dados indesejados chegaram à rede em primeiro lugar, mas o problema está resolvido por enquanto. Estamos fazendo um relatório de erro com a HP.

Em primeiro lugar, esses pacotes não são NBNS, na verdade são pacotes Universal Plug-n-Play que tentam procurar dispositivos habilitados para "Internet Gateway Device". O UPNP-IGD usa multicast IPv4 para localizar esses dispositivos de borda. O protocolo, como é, diz que deveria haver apenas um. A distribuição está na carga útil do pacote:

M-SEARCH * HTTP / 1.1
Anfitrião: 239.255.255.250: 1900
ST: urn: schemas-upnp-org: dispositivo: InternetGatewayDevice: 1
Man: "ssdp: discover"
MX: 3

.xmlsoap.org / ws / 2004/08 / addressing "xmlns:

O IGD é usado por alguns aplicativos para informar aos gateways NAT do consumidor como lidar com a travessia de NAT para determinados protocolos. Aplicativos de mensagens instantâneas e similares. Você pode fazer o Wireshark mostrar melhor as coisas, dizendo-lhe para decodificar UDP / 137 como HTTP para essa captura.

Agora, por que isso está causando uma tempestade multicast é a grande questão. Você está recebendo o mesmo tipo de pacote bem antes da tempestade chegar, mas eles estão sendo enviados corretamente para 239.255.255.250:1900. O pacote 23955, de fato, vem do mesmo dispositivo que inicia a tempestade em 23968. No entanto, o pacote 23968 mostra o mesmo endereço MAC de destino (um indicando IPv4 Multicast), mas tem um endereço IP de destino que está no seu bloco / 16 e NÃO deve seja multicast.

O pacote 23604 também está muito malformado. Ele possui um cabeçalho Ethernet válido, mas o cabeçalho IP é estranhamente truncado e termina na mesma string UPNP-IGD citada acima. O dispositivo que emitiu esse pacote estranho e estranho é o mesmo dispositivo (bem, vem do mesmo endereço MAC de qualquer maneira) que o pacote 23968 que iniciou a tempestade multicast.

Minha melhor aposta neste momento é que o dispositivo em 00: 1F: 3B: D2: 5E: 6D seja mangueira de alguma forma ou não esteja lidando exclusivamente com essas solicitações de pesquisa UPNP corretamente. O pacote 24717 mostra outra solicitação M-SEARCH indo para 239.255.255.250:3702 que também vem do mesmo dispositivo. Endereço IP correto, porta incorreta (deve ser 1900).

Meu palpite é que a tempestade multicast está sendo iniciada por um pacote com um endereço IP de difusão ponto a ponto que chega com um endereço MAC de difusão seletiva e seus dispositivos de rede não estão lidando com esse caso inválido corretamente. Isso é sugestivo no fato de que todos os pacotes após o inicial reivindicam a origem do mesmo IP (143.226.8.185), mas o endereço MAC é todo diferente. Você tem um dispositivo defeituoso que conseguiu encontrar um bug no processamento de difusão seletiva / unicast de seus dispositivos de rede.

@ Brad: Acabei de ver isso e estou me perguntando se isso lhe dá alguma idéia do problema.

http://support.microsoft.com/kb/317843

Minha recomendação é abrir o gerenciador de tarefas no host que está enviando a transmissão e tentar fechar um a um todos os aplicativos que poderiam enviar algo para a rede e, ao mesmo tempo, procurar os pacotes na rede (Wireshark) para pesquisar para o aplicativo que está dando problemas.