Chapter4 Edit Interface/Connection
General
4-14
Cisco Router and Security Device Manager Version 2.2 Users Guide
OL-4015-08
Description
You can enter a short description in this field. This description will be visible in
the theEdit Interfaces and Connections window. A description can help others
who might be less familiar with the router configuration to understand the purpose
of the configuration. A description such as Accounting, or Test Ne t 5 lets
SDM users know without their having to examine details of the configuration.
IP Directed Broadcasts
An IP directed broadcast is a datagram which is sent to the broadcast address of a
subnet to which the sending machine is not directly attached. The directed
broadcast is routed through the network as a unicast packet until it arrives at the
target subnet, where it is converted into a link-layer broadcast. Because of the
nature of the IP addressing architecture, only the last router in the chain, the on e
that is connected directly to the target subnet, can conclusively identify a directed
broadcast. Directed broadcasts are occasionally used for legitimate purposes, but
such use is not common outside the financial services industry.
IP directed broadcasts are used in the extremely common and popular smurf
Denial-of-Service attack, and they can also be used in related attacks. In a smurf
attack, the attacker sends ICMP echo requests from a falsified source address to a
directed broadcast address, causing all the hosts on the target subnet to send
replies to the falsified source. By sending a continuous stream of such re quests,
the attacker can create a much larger stream of replies, which can completely
inundate the host whose address is being falsified.
Disabling IP directed broadcasts causes directed broadcasts that would ot herwise
be exploded into link-layer broadcasts at that interface to be dropped instead.
IP Proxy ARP
ARP is used by the network to convert IP addresses into MAC addresses.
Normally ARP is confined to a single LAN, but a router can act as a proxy for
ARP requests, making ARP queries available across multiple LAN segments.
Because it breaks the LAN security barrier, proxy ARP should be used only
between two LANs with an equal security level, and only when necessary.