For CVE-2018-19299, Are systems that do not have IPv6 connection tracking enabled affected?

If a pure SFP+ switch was released (with redundant internal power supplies), I'd pick up at least 10.

On 6.24 we can handle about 1.1 or 1.2M PPS of syn flood. After that the packet loss causes the router to lock up. I'm hoping the CCR1072 will double that when it finally arrives. Still, we're probably going to have to move in a different direction for our edge routing since we use 10G ethernet. Oth...

What TCP port is under attack? If it's port 80 then I would suggest signing up for a service like Cloudflare. The services that are targeted aren't http based unfortunately, so couldflare isn't an option. Our total connectivity is 20 gigabits, so ideally we would like to pass any traffic we recieve...

Hello, I'm hoping theres an easy answer for this. We are seeing some low end DDOS attacks around 1-2 gbit/sec. The attack signature is SYN packets with random source IPs with a destination within the network that the CCRs do edge routing for. The CPU level is basically 100% the whole time. We did so...

We never have problems pushing more than 1gig via TCP on a single connection. I don't think I've seen a single core rise above 3 or 4% when routing a few gig. Keep in mind, we have no queues, no firewall, and fastpath is on, so perhaps thats where you're experiencing the ceiling?

We use the 1036-8G-2S+ models for our edge routers, and they work great. Here's how we have them configured: 1) No firewall rules, so fastpath is enabled. If we need to drop packets, we add a null/blackhole route. We also announce that IP to our upstreams blackhole BGP session. 2) Any filtering via ...

Is the CPU on the CCR maxed out during the tests?

Also, in Winbox, under Interfaces, add the columns Tx Drops, Rx Drops, Tx Errors, and Rx Errors if they aren't there already. During your testing, check to make sure these are all holding 0.

Let us know how it goes.

Ram for the CCR series is pretty inexpensive. I had an 1036-8g-2s+-EM model show similar symptoms. Replaced the 16G with one 8G stick (http://www.neweggbusiness.com/product/product.aspx?item=9b-20-139-976) and its been up for 34 days since pushing a few gb/s average with 3 full tables. My recommenda...

Are you going to be doing just BGP and routing, or are you going to use filters on the traffic as well? We have 3 in production doing multi gigabit routing, each with full BGP tables from at least 3 peers, and they aren't breaking a sweat. We don't have any queues or firewall filters though, so I ca...

The lack of outbound packets is via a null route (blackhole), not a firewall rule, so I would think the fastpath should still work. The CPU usage was double what it was in the screenshot prior to the null route being added, so even if a blackhole avoids fastpath, it still wasn't forwarding with the ...

Hello, We have 2 CCR's in production right now, running ROS v 6.15, and when we receive DDOS traffic to hosts on our network in the 600k PPS range, we are seeing %50-75 CPU usage. At 1G, the systems lock up and restart. IF the systems are supposed to route many millions of packets per second, then I...

We use 2 CCR's in a production environment replacing 2x vyatta systems. We receive full detailed tables from multiple carriers on each router, in v4 and v6, and take peering carrier routes from about 5 peers on a local IX. So far, no complaints. I can confirm that the table reload time can be anywhe...

Hello, Quick question. Do the CCR models support fastpath in IPv6, or is that done in software? We run a good deal of V6 traffic, especially with small packets, so fastpath will be quite useful for us. Currently running a 1036-8g-2s+ and a 1016 in production now for our V4 network. Let me know Thanks

Is there any word on the CCR line supporting IPv6 in fastpath? I only see V4 documentation for it.