topic Cisco Asa Scanning attack in Network Security

Cisco Asa Scanning attack

emilioj.romero — Mon, 11 Mar 2019 21:00:51 GMT

How to see the ip address of the attack host?

Show the logging

Jul 19 09:43:15 10.239.67.1 Jul 19 2011 09:43:11: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 1 per second, max configured rate is 10; Current average rate is 5 per second, max configured rate is 5; Cumulative total count is 3113

Jul 19 09:43:15 10.239.67.1 Jul 19 2011 09:43:15: %ASA-4-733100: [ Scanning] drop rate-2 exceeded. Current burst rate is 0 per second, max configured rate is 8; Current average rate is 5 per second, max configured rate is 4; Cumulative total count is 21589

Regards

Cisco Asa Scanning attack

Parminder Sian — Wed, 27 Jul 2011 10:20:58 GMT

Hi Emilio,

This can be fixed by using threat detection feature on ASA. Here's a link for your help:-

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml#sol6

Note: If you do not want the drop rate exceed warning to appear, you can disable it by running the

no threat-detection basic-threat command.

Hope this helps,

Sian

Cisco Asa Scanning attack

tranquocphu — Wed, 27 Jul 2011 14:57:32 GMT

Hi Parminder

How can I shun a host or a network? My ASA is under scanning attack now. Thanks.

Cisco Asa Scanning attack

lcaruso — Wed, 27 Jul 2011 15:14:12 GMT

Just use the shun command

ciscoasa# shun ?

Hostname or A.B.C.D Specify source IP address of a mischievous host

Re: Cisco Asa Scanning attack

tranquocphu — Wed, 27 Jul 2011 15:29:00 GMT

Hi lcaruso

I use the shun command shun x.x.x.x x.x.x.x source port (need to specify a range of ports or shun all source ports) 80 0.

How can I shun all or a range of ports of the source port? Source ports are showing dynamically on ASA screen. Thanks.

Re: Cisco Asa Scanning attack

praprama — Wed, 10 Aug 2011 21:04:13 GMT

Hi Peter,

I am not sure i dunderstand your requirement well enough to be answering this. Are you looking at shunning a range of ports for a particular IP address on the ASA?

Regards,

Prapanch