Subject: EGP Version 0

From: [email-masked]
Date: Mon, 24 Oct 2005 18:16:46 +0800

HI, I'm newbie in this mailing-list. 

My network analyzer has captured several packets which have been decoded as 
EGP packet with version 0 (IP protocol=8, EGP: Version=0, type=0).  I've tried 
searching for information on these packets, but I can't find any information 
about EGP version 0.  Could someone please shed some light or hyperlink about 
these kind of packets.  Why these kind of packets occur in my network? Thank.

_______________________________________________
routing-discussion mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/routing-discussion

---

From: Magnus Danielson <[email-masked]>
Date: Mon, 24 Oct 2005 14:29:33 +0200 (CEST)

From: [email-masked]
Subject: EGP Version 0
Date: Mon, 24 Oct 2005 18:16:46 +0800

> these kind of packets.  Why these kind of packets occur in my network? Thank.

See if not RFC 827 and RFC 904 makes you wiser. Further EGP RFCs are RFC 888,
RFC 890, RFC 911 and RFC 1092.

If you have true EGP packets on your network, I would assume you have one or
more missconfigured routers. Follow the trace to the source(s) and see what
those boxes are, turn the necessary knowbs.

Cheers,
Magnus

---

From: Fred Baker <[email-masked]>
Date: Mon, 24 Oct 2005 13:40:41 +0100

RFCs 827 and 911 define EGP; that EGP is version 1.

I suspect you have a protocol-agile application that has absconded  
with the number 8. I would look hard at the source and destination IP  
addresses and ask yourself whether these are doing anything ELSE that  
is unusual. I'll bet they are.

---

From: Curtis Villamizar <[email-masked]>
Date: Mon, 24 Oct 2005 11:59:23 -0400

> > these kind of packets.  Why these kind of packets occur in my  

I was tempted to just put it more bluntly and say that my first guess
is that you or someone else is under attack.  People in the security
community would probably be interested in looking at entire payload of
the packets.  I don't know of any vulnerability to malformed EGP but
I'm not anywhere near up to date with security issues.

btw- EGP was normally sent via UDP with TTL=1 and version 1.  The
packets are suspect since the TTL would have to be >1 (unless its an
adjacent host or router) and there was no version 0 ruling out a
misconfigured router running EGP.

Curtis