Banyan Vines

Banyan Vines

[tony.chamberlain]

Does anyone know what it means if you are running pptp and in
/var/log/messages you get a message "unsupported protocol Banyan Vines"
(along with a lot of unsupported protocol messages which are just
hex values), or what to do about it?

Re: Banyan Vines

[James Carlson]

tony.chamberlain@lemko.com writes:
> Does anyone know what it means if you are running pptp and in
> /var/log/messages you get a message "unsupported protocol Banyan Vines"
> (along with a lot of unsupported protocol messages which are just
> hex values), or what to do about it?

It means you're getting garbled packets from the peer.

If it's persistent and doesn't correct itself over time, the most
plausible reason (I think) would be that you're using MPPE (MS
proprietary packet encryption) and there's a bug in that code.

If it just happens intermittently and then fixes itself, I'd ignore
it.  The cause would be dropped or corrupted packets and recovery by
the encryption code.

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>

Re: Banyan Vines

[tony.chamberlain]

-----Original Message-----
From: James Carlson [mailto:carlsonj@workingcode.com]
Sent: Tuesday, October 28, 2008 09:02 AM
To: tony.chamberlain@lemko.com
Cc: linux-ppp@vger.kernel.org
Subject: Re: Banyan Vines

tony.chamberlain@lemko.com writes:
> Does anyone know what it means if you are running pptp and in
> /var/log/messages you get a message "unsupported protocol Banyan Vines"
> (along with a lot of unsupported protocol messages which are just
> hex values), or what to do about it?

It means you're getting garbled packets from the peer.

If it's persistent and doesn't correct itself over time, the most
plausible reason (I think) would be that you're using MPPE (MS
proprietary packet encryption) and there's a bug in that code.

If it just happens intermittently and then fixes itself, I'd ignore
it.  The cause would be dropped or corrupted packets and recovery by
the encryption code.

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>


It appeared to be happening every couple minutes and causing
the VPN to go down (even though pppd was still running) so I had
to kill pppd and let it restart. That fixed it till the next time.
So probably like you say it is mppe.

Thanks

RE: Banyan Vines

[Michael St. Laurent]

Might it not also be that the client connecting has the Banyan Vines
protocol installed?

> -----Original Message-----
> From: linux-ppp-owner@vger.kernel.org [mailto:linux-ppp-
> owner@vger.kernel.org] On Behalf Of James Carlson
> Sent: Tuesday, October 28, 2008 7:03 AM
> To: tony.chamberlain@lemko.com
> Cc: linux-ppp@vger.kernel.org
> Subject: Re: Banyan Vines
> 
> tony.chamberlain@lemko.com writes:
> > Does anyone know what it means if you are running pptp and in
> > /var/log/messages you get a message "unsupported protocol Banyan
Vines"
> > (along with a lot of unsupported protocol messages which are just
> > hex values), or what to do about it?
> 
> It means you're getting garbled packets from the peer.
> 
> If it's persistent and doesn't correct itself over time, the most
> plausible reason (I think) would be that you're using MPPE (MS
> proprietary packet encryption) and there's a bug in that code.
> 
> If it just happens intermittently and then fixes itself, I'd ignore
> it.  The cause would be dropped or corrupted packets and recovery by
> the encryption code.
> 
> --
> James Carlson         42.703N 71.076W
<carlsonj@workingcode.com>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ppp"
in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

This e-mail may contain technical information which is controlled by the United States Government, Department of State, International Traffic & Arms Regulations (ITAR) (22 CFR 120-130) which requires an export license prior to sharing with foreign persons. Lacking such license, ITAR technical data is limited to US Legal Residents only. It is the responsibility of the organization and individual in control of this data to abide by US export laws. If you are not a US Legal Resident, immediately forward this e-mail to notify@hartwellcorp.com or reply to sender without reading any further. Take no other action with this e-mail until contacted.

Notice:  The information in this document and document itself, in whole or in part, in any form ("Information") is proprietary and/or confidential property of Hartwell Corporation, Placentia, California.  Hartwell Corporation and its successors and assignees retain and reserve all right, title and interest in this information in whole or in part and in all forms.  This Information is provided to the original recipient only for confidential use, with the understanding that it will not be used in any manner detrimental to the interests of Hartwell Corporation, and subject to return on request.  Reproduction, transmission, distribution or publication of this Information in any form, in whole or in part, for any purpose without prior written permission of Hartwell Corporation is strictly prohibited.

RE: Banyan Vines

[James Carlson]

Michael St. Laurent writes:
> Might it not also be that the client connecting has the Banyan Vines
> protocol installed?

That's probably _really_ unlikely in 2008.  ;-}

Plus, the original poster noted that he had this:

> > > (along with a lot of unsupported protocol messages which are just
> > > hex values), or what to do about it?

That almost certainly makes Banyan Vines a red herring.  We just
happened to see a corrupted packet that started with hex 35 or 00 35.

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>

Re: Banyan Vines

[tony.chamberlain]

-----Original Message-----
From: James Carlson [mailto:carlsonj@workingcode.com]
Sent: Thursday, October 30, 2008 03:09 PM
To: 'Michael St. Laurent'
Cc: tony.chamberlain@lemko.com, linux-ppp@vger.kernel.org
Subject: RE: Banyan Vines

Michael St. Laurent writes:
> Might it not also be that the client connecting has the Banyan Vines
> protocol installed?

That's probably _really_ unlikely in 2008.  ;-}

Plus, the original poster noted that he had this:

> > > (along with a lot of unsupported protocol messages which are just
> > > hex values), or what to do about it?

That almost certainly makes Banyan Vines a red herring.  We just
happened to see a corrupted packet that started with hex 35 or 00 35.

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>

============
Especially since the VPN had been working (with mmpe or is it mppe?) for
6 or 7 months.

Could it be hackers?

Re: Banyan Vines

[James Carlson]

tony.chamberlain@lemko.com writes:
> Especially since the VPN had been working (with mmpe or is it mppe?) for
> 6 or 7 months.
> 
> Could it be hackers?

Possible, but unlikely.  They'd have to be faking the PPTP headers but
then falling down on the encryption portion.  Why bother?  It's not
even disruptive, let alone a serious threat, and there are obviously
much better things in the world to attack.  Even sending out random
TCP RST packets to snipe away connections is a worse thing to do, and
it's far simpler.

My money would be split on two bets: a bug in MPPE or a high
underlying packet loss/reordering rate.

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>