🚀 go-pugleaf

Re: the Doom game and cisco routers with novell ipx routing enabled

[stop reading this if you are bridging IPX traffic]

Ok, I took fifteen minutes and installed it on a lab servers and ran
it in network mode. How Horrible! They let the person starting the
game pick the netware socket to use. The default of 0 gets a socket of
0x869C picking a socket of decimal 666 gets 0x29a. IPX Packet type is
0 (unknown).  They should get some authorized sockets to use assigned
by Novell, Inc.  then the user can pick from among the list of
authorized Doom sockets.  Otherwise you won't be able to reliably
filter these if they can choose random socket numbers.

One possible way to minimize the damage done by Doom on a cisco router
running Novell IPX routing is to avoid using the novell helper-address
-1.ffff.ffff.ffff command and instead use directed addresses in the
helper-address instead of a flooding address.

A second thing to do would be to install an access-list to define what
gets forwarded by the helper-address functionality.

I would start by allowing only NetBIOS to be forwarded to areas that
have NetBIOS servers or other NetBIOS devices. Assumption networks
BA, BB, and BC have such devices.

Interface ether 0
novell network BADBAD
novell helper-address BA.ffff.ffff.ffff
novell helper-address BB.ffff.ffff.ffff
novell helper-address BC.ffff.ffff.ffff
novell helper-list 900

access-list 900 permit 0 -1 455 -1 455
access-list 900 permit 4 -1 455 -1 455
access-list 900 permit 20 -1 455 -1 455

Then only if the Doom players pick a NetBIOS socket will you have that
traffic leaving the local network. There will be increased load on the
ciscos attached to that segment as they filter this traffic, but other
segments should not see this traffic. Additional packets might need to be
permitted other than NetBIOS, you'd have to add those as you discover
them. You also may need to adjust the source socket to be something other
than 455, 0 can be used to match all sockets.

Anyone have a contact at the Doom writers, so I can get a beta copy of
the new version and test the network impact? ;-)

Regards,
John Wright
cisco Systems, Inc.