What is the best way to detect a re-configured router?

[Bob Albrecht]

Changing router firmware can take a long time. It's faster to pull the
"route processor"/supervisor card and replace it with one that's already
upgraded. The new card will have the same config, including engineID.
However, counters such as engineBoots and engineTime will be reset.


We see same engineID come up but with fewer engineBoots or lower
engineTime, there is a security discrepancy that must be addressed.

What is the authoritative way to detect this situation?
--
Bob Albrecht
SevOne
550 South College Avenue
Wilmington, DE 19808
434-249-1747
--
------------------------------

SevOne, Inc. reserves the right to monitor the transmission of this message
and to take corrective action against any misuse or abuse of its e-mail
system or other components of its network.

The information contained in this e-mail may be confidential and/or legally
privileged. It is intended solely for the addressee. If the reader of this
message is not an intended recipient, you are hereby notified that any
unauthorized review, use, disclosure, dissemination, distribution, or
copying of this communication, or any of its contents, is strictly
prohibited and may be unlawful. If you have received this communication in
error, please reply to the sender and destroy all copies of the message.
To contact us directly, send to ***@sevone.com.

[Lee]

Post by Bob Albrecht
Changing router firmware can take a long time. It's faster to pull the
"route processor"/supervisor card and replace it with one that's already
upgraded. The new card will have the same config, including engineID.
However, counters such as engineBoots and engineTime will be reset.
We see same engineID come up but with fewer engineBoots or lower
engineTime, there is a security discrepancy that must be addressed.
What is the authoritative way to detect this situation?

Keep track of the serial numbers on the various bits of hardware in the box.

I like RANCID - even if the config doesn't change you still get an
email showing the serial number / firmware version / software version
changes on the line cards.
(note that "supervisor card" is a subset of "line card" :)

Regards,
Lee

[Mathias Wegner]

Changing router firmware can take a long time. It's faster to pull the "route processor"/supervisor card and replace it with one that's already upgraded. The new card will have the same config, including engineID. However, counters such as engineBoots and engineTime will be reset.
We see same engineID come up but with fewer engineBoots or lower engineTime, there is a security discrepancy that must be addressed.
What is the authoritative way to detect this situation?

I don’t know about an authoritative, but if the uptime has reset at the same time that boots and time changed, that’s a pretty solid indicator that something like this has happened.


Mathias