<div class="gmail_quote">On Sat, Jun 2, 2012 at 1:38 PM, Asif Iqbal <span dir="ltr"><<a href="mailto:vadud3@gmail.com" target="_blank">vadud3@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="gmail_quote"><div class="im">On Sat, Jun 2, 2012 at 2:46 AM, Kiss Gabor (Bitman) <span dir="ltr"><<a href="mailto:kissg@ssg.ki.iif.hu" target="_blank">kissg@ssg.ki.iif.hu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>> Am I experiencing a bug?<br>
><br>
> I am running tac_plus F4.0.4.19<br>
><br>
> I see 110444 of the following type of error in 14 hrs.<br>
><br>
> Jun 1 16:36:27 hlr-tacacs-01 tac_plus[17512]: Read -1 bytes from<br>
> <a href="http://router.example.net" target="_blank">router.example.net</a> , expecting 12<br>
<br>
</div>It seems to be rather an "attack".<br>
</blockquote><div><br></div></div><div>This is valid traffic, not an attack.</div><div class="im"><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Somebody continously connect to <a href="http://router.example.net" target="_blank">router.example.net</a> then disconnects.<br>
The router does the same with your TACACS+ server.<br>
<span><font color="#888888"><br>
Gabor<br>
</font></span></blockquote></div></div><br></blockquote><div><br></div><div>How do I verify if those are keep-alive requests. This url suggests I am experiencing those keep-alive</div><div>chats</div><div><br></div><div>
<a href="http://blog.xbsd.org/2010/10/20/cisco-css-and-tacacs">http://blog.xbsd.org/2010/10/20/cisco-css-and-tacacs</a></div><div><br></div><div>I have thousands of routers. It would be lot of work to add the disable in all of them.</div>
<div>Is there may be another approach to this short from ignoring this massive amount</div><div>of noises?</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br clear="all"><div class="HOEnZb"><div class="h5"><div><br></div>-- <br>Asif Iqbal<br>PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu" target="_blank">pgp.mit.edu</a><br>A: Because it messes up the order in which people normally read text.<br>
Q: Why is top-posting such a bad thing?<br><br><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Asif Iqbal<br>PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu">pgp.mit.edu</a><br>A: Because it messes up the order in which people normally read text.<br>
Q: Why is top-posting such a bad thing?<br><br><br>