Analyzing Router IP Address Configuration Issues
When a router receives a packet destined for an unknown router IP address (meaning the router does not know the target route), it attempts to send an ARP broadcast to resolve it. If a target host responds to this ARP broadcast, the router forwards the packet to that host.
If the router receives no response, it will send ARP requests for the next 4 packets. If, by the time the 6th packet arrives, the target host’s MAC address has still not been resolved, the router will, by default, discard the 6th and subsequent packets for the next 20 seconds and return an ICMP “Host Unreachable” message to the source host.
This is also confirmed by the first entry in Computer B’s logs. The router sent an ARP query into that network segment, looking for the computer with the router IP address “222.222.222.191”, but no computer responded. The router then assumed that the target host did not exist in that segment, so it returned an ICMP message to the source computer indicating the destination host was unreachable, notifying the source of the problem, and simultaneously discarding the original packet. At this point, the issue becomes clear: the ICMP messages logged by the router were all “Destination Unreachable” messages sent back to the source addresses. So, why were these external router IP addresses looking for computers inside the campus? Analyzing the collected data makes it easy to discover that these external hosts were mainly seeking out three specific internal computers. Checking historical logs reveals the primary common records of these three computers:
- 07:52:19 Jul 09 07:50:02 %ACL_LOG-I-PERMIT, ACL [out]
- on "uplink" TCP 222.222.222.136:3159 -> 61.173.209.101:6881
- 08:00:15 Jul 09 07:53:50 %ACL_LOG-I-DENY, ACL [out]
- on "uplink" TCP 222.222.222.12:3194 -> 219.121.133.197:6883
- 08:00:15 Jul 09 07:57:59 %ACL_LOG-I-DENY, ACL [out]
- on "uplink" TCP 222.222.222.220:3196 -> 210.238.6.177:6881
The ports used by these three hosts to connect to the target hosts were consistently between 6881 and 6889, which are commonly used ports for the now-popular BitTorrent (BT) downloads. No wonder such logs never appeared before, only emerging recently with the popularity of BT. The main reason is that when these hosts used BT to download, records were left on the BT tracker server, allowing other hosts to download resources from them. When these hosts shut down, the router informed the external hosts that they could not be found.
Since the logging service records information at Layer 3 and above, and the packets received by the router were discarded at Layer 2, these abnormal incoming packets were not recorded in the logs. To reduce the volume of router logs, use the “ip disable icmp-messages destination-unreachables” command in configuration mode to suppress the forwarding of such messages. Both of these faults were triggered by ICMP, and from a certain perspective, neither was a system configuration issue but rather caused by external factors. Troubleshooting such faults requires a degree of analysis to identify the cause before making the corresponding configuration changes to resolve them.
Troubleshooting Router IP Address Configuration Failures
First, connect the COM port of your laptop to the router’s CONSOLE port using the router’s dedicated CONSOLE cable. Launch a terminal emulator like HyperTerminal on the laptop to establish a connection with the router. After powering on the router, you will see loading information similar to the following in the terminal:
- Processor: R5000 rev 2.1 [0x2321], 198 MHz, (bus: 66 MHz), 64 MB DRAM
- I-Cache 32 KB, linesize 32. D-Cache 32 KB, linesize 32
- L2-Cache 512 KB, linesize 32, cache enable
- Mounting 8MB Linear external flash card …Done
- initializing system …….Failure
- Autoboot in 2 seconds – press ESC to abort and enter prom.
The last line indicates that system initialization failed. Upon seeing “Autoboot in 2 seconds 鈥?press ESC to abort and enter prom.”, immediately press the “ESC” key to enter boot mode. By default, the router boots using the IOS system image file stored on the FLASH card. If this IOS file is missing, system initialization fails. To successfully boot the system, you must re-download the system image file. We can use the following steps to recover the lost IOS:
Set the router IP address of your laptop and the router’s Ethernet management port address to the same subnet. For example, set your laptop’s router IP address to 10.10.10.2, with a mask of 255.255.255.0. Then, use a crossover cable to connect the computer’s network card to the SSR’s en0 interface. This concludes the analysis of router IP address related issues; you should have gained some understanding by now.
銆怑ditor’s Picks銆?/p>