Enterprise QoS Solution Reference Network Design Guide
Enterprise QoS Solution Reference Network Design Guide
Enterprise QoS Solution Reference Network Design Guide
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Chapter 4 Branch Router <strong>QoS</strong> <strong>Design</strong><br />
Version 3.3<br />
Branch Router LAN Edge <strong>QoS</strong> <strong>Design</strong><br />
Through infected hosts actively scanning for additional exploitable hosts (worm vector)<br />
Through infected hosts actively scanning for back doors created by Code Red (worm vector)<br />
NIMDA did not appear to exhibit intentional destructive capabilities; to date, NIMDA’s activities have<br />
been restricted to its self-propagation, which has the side effect of a DoS (flooding) attack.<br />
NIMDA propagates itself by copying, downloading, or executing a file called readme.eml. Therefore,<br />
NBAR can be used to check the payload of HTTP packets to see if they are propagating this file, as<br />
shown in Example 4-12.<br />
Example 4-12 NBAR Policies to Identify NIMDA<br />
!<br />
class-map match-any NIMDA<br />
match protocol http url "*readme.eml*" ! Identifies HTTP with "readme.eml"<br />
!<br />
Verification command:<br />
show policy<br />
NBAR Versus SQL Slammer<br />
After the NIMDA infection subsided, the Internet saw the appearance of smaller infectious worms. In<br />
January 2003, a new worm infected the Internet at such a high rate that it was categorized as a flash<br />
worm. This worm, termed SQL Slammer, once again targeted Microsoft Windows servers; specifically,<br />
this worm targeted servers running Microsoft Structured Query Language (SQL) Server software. The<br />
vulnerability exploited by SQL Slammer had been published in July 2002, and a patch from Microsoft<br />
was available at that time as well. Even though this patch was available for almost six months, SQL<br />
Slammer spread with incredibly high efficiency.<br />
SQL slammer is a 376-byte User Datagram Protocol (UDP)–based worm that infects Microsoft SQL<br />
servers through UDP port 1434. Example 4-13 shows a signature string from the SQL Slammer worm.<br />
Example 4-13 SQL Slammer Worm Signature String<br />
\x04\x01\x01\x01\x01\x01.*[.][Dd][Ll][Ll]<br />
Because of its small size, the SQL Slammer worm is contained in a single packet. The fast scanning rate<br />
of SQL Slammer is achieved not only because of this small size, but also because the worm is UDP<br />
based. The worm does not have to complete a handshake (necessary with TCP-based worms) to connect<br />
with a target system.<br />
SQL Slammer reached its full scanning rate of 55 million scans per second within 3 minutes of the start<br />
of the infection and infected the majority of vulnerable hosts on the Internet within 10 minutes of the<br />
start of the infection, with an estimated 300,000 infected hosts overall. A major consequence of such a<br />
fast scanning rate was that edge networks were overwhelmed by the amount of traffic generated by the<br />
worm. SQL Slammer’s doubling rate was approximately 8.5 seconds. In contrast, CodeRedv2’s doubling<br />
rate was about 37 minutes.<br />
SQL Slammer does not carry an additional harmful payload (beyond its enabling exploit code), and its<br />
primary purpose is to cause DoS through exponential self propagation.<br />
NBAR can be used to detect the SQL Slammer worm by mapping a custom PDLM to UDP port 1434<br />
and matching on the packet length (376-byte worm + 8 bytes of UDP header + 20 bytes of IP header =<br />
404 bytes). This is shown in Example 4-14.<br />
<strong>Enterprise</strong> <strong>QoS</strong> <strong>Solution</strong> <strong>Reference</strong> <strong>Network</strong> <strong>Design</strong> <strong>Guide</strong><br />
4-17