Administering TCP/IP
Managing the Routing Information Protocol (RIP)
MAX Administration Guide
7-23
address of the intended victim. When all the machines at the intermediary’s site respond to the
ICMP Echo Requests, they send replies to the victim’s device. An attacker can send DoS
attacks to multiple intermediaries at the same time, causing all of the intermediaries to direct
responses to the same victim.
Both the intermediary and victim of a DoS attack can suffer severely degraded network
performance. To protect against DoS attacks, you should disable IP-directed broadcasts on the
MAX unit. By disabling these broadcasts, you deny an attacker the ability to direct IP
broadcast traffic onto your network. In addition, you should prevent the MAX unit from
responding to ICMP packets sent to IP broadcast addresses. Because this traffic does not travel
through a router to reach the machines on the local network. If someone compromises a
machine on your network, he or she may try to launch an attack using the MAX as an
intermediary, sending the ICMP Echo Request packet to the IP broadcast address of the local
network.
The Forward Directed Bcast parameter specifies whether or not the MAX unit responds to
directed-broadcast ICMP echo requests. The Reply DirectedBcast Ping parameter specifies
whether the MAX unit forwards directed broadcast traffic to the Ethernet interface. Verify the
configuration of the Forward Directed BCast and the Reply DirectedBcast Ping parameters in
the Ethernet menu’s Mod Config profile.
Managing the Routing Information Protocol (RIP)
Routing Information Protocol (RIP) is a distance-vector protocol found in both the NetWare
and TCP/IP protocol suites. The protocol creates a database of routing information that it
gathers from periodic broadcasts by each router on a network.
Internet Packet Exchange (IPX) routers broadcast RIP updates periodically and every time a
WAN connection is established. The MAX receives IPX RIP broadcasts from a remote device,
adds 1 to the hop count of each advertised route, updates its own RIP table, and broadcasts
updated RIP packets on connected networks in a split-horizon fashion.
The MAX follows standard IPX RIP behavior for routers when connecting to non-Lucent
units. However, when it connects to another Lucent unit configured for IPX routing, both ends
of the connection immediately exchange their entire RIP tables. In addition, the MAX
maintains those RIP entries as static until it is reset or power cycled.
The MAX recognizes network number -2 (0xFFFFFFFE) as the IPX RIP default route. When
it receives a packet for an unknown destination, the MAX forwards the packet to the IPX
router advertising the default route. If more than one IPX router is advertising the default route,
the unit makes a routing decision based on the hop and tick count. For example, if the MAX
receives an IPX packet destined for network 77777777 and it does not have a RIP table entry
for that destination, the MAX forwards the packet towards network number FFFFFFFE, if
available, instead of simply dropping the packet.
Verifying the transmission path to NetWare stations
The IPXping command provides network layer verification of the transmission path to
NetWare stations. The command works on the same LAN as the MAX or across a WAN
connection that has IPX Routing enabled. Following is the command’s syntax:
