Why when a link goes down within the domain for OSPF to broadcast outside the network domain? What it seems like every ip address within my network starts transmitting out a LOT of packets. What I noticed was around 7k pps per IP address. It happens when a link goes offline. Its just wierd I can recreate the problem generate a log file if you want me to.

It appears to be DST port 53 to all my ip addresses not just ones that would be affected by the link going down. Normal traffic on in my wan interface is Tx 10-15mbps Rx 70-120mbps when the link goes down and routes are gone I see 200 mbps in both directions with dst port being 53 to every ip on my network. This is just odd and doesnt make any sense. HELP!


http://i.imgur.com/a7gqcZk.png
Not normal


http://i.imgur.com/BYygQeo.png
Normal traffic

Thanks,
Devin

I'm not sure that I follow your question.

The traffic in the graphic is DNS lookups which are failing - note the zero rx rate.

I'm not sure that I follow your question.

The traffic in the graphic is DNS lookups which are failing - note the zero rx rate.

Yes, the traffic is coming from 1 ip addess to multiple ip addresses when the link is down. It only happens when I break a link in the ospf area. I block multiple dns responses from servers when the connection limit is higher than 40 a botnet detection type of rule. The 0 rx rate is cause im dropping the traffic because it met the rule.

There are actually multiple IPs showing on both sides - both your IPs and external. Not really enough information to know what is going on, but assuming that you do actually run DNS services which are accessed from external addresses (i.e. DNS services for sites you are hosting etc.) check that when the link is down you aren't bouncing the DNS traffic around in a routing loop.

There are actually multiple IPs showing on both sides - both your IPs and external. Not really enough information to know what is going on, but assuming that you do actually run DNS services which are accessed from external addresses (i.e. DNS services for sites you are hosting etc.) check that when the link is down you aren't bouncing the DNS traffic around in a routing loop.

When the link goes down the routes are dropped from the routing table. So the traffic has no where to go, but to be dropped. I do host 2 dns servers but this traffic's DST is port 53 on all the ip addresses that are down, but why would the ip addresses that are down be receiving traffic on 53 anyway if it wasnt a DNS server. I can do a pcap and post it if that would help.

http://i.imgur.com/co1wxmI.png

Here is a picture of the capture. It seems that someone is looking up ripe.net on all my addresses like I originally stated, but the traffic increases when the link goes down.

I suggest looking at your routing and NAT entries to unravel this.

If external clients are sending DNS queries to your IP range and your internal route to those IPs is down then you *might* be sending the traffic back out to your ISP who promptly sends it back to you giving the appearance of heavy traffic.

I suggest looking at your routing and NAT entries to unravel this.

If external clients are sending DNS queries to your IP range and your internal route to those IPs is down then you *might* be sending the traffic back out to your ISP who promptly sends it back to you giving the appearance of heavy traffic.

There is 0 NATs in this router. The routing is dynamic via OSPF.

Do you run BGP to your ISP or do they send traffic to you for your IPs based on a static route?

In that case check that when the link goes down and you lose the internal routes to those IPs that you are not then forwarding the traffic back to your upstream ISP who is then forwarding them back to you due to a static entry in your direction.

Right now it is currently set up as static routes 2 /23s and /27 to me. That makes sense so should I just statically route everything in my main router as backup in case the link stops working?

Edit: would this be the best solution because in about 2 months we will be putting bgp into use when arin approves us for our own ip addresses.

Update: THIS FIXED THE PROBLEM! Thank you so much. That makes sense.. That drove me up a wall for about 2 weeks..

Thanks,
Devin