Cisco 3850 Massive requests from the LAN

[Aleck_Sei]

Hi all!

We have a LAN network with a CORE 3850 layer 3 switch and several 2960X layer 2 switches.

We have received a notice from a security agency indicating that a device on our network is making massive requests against a specific IP. The only thing they provide us is the public IP of our WAN router.

How can we determine, at the LAN level, which machine is the originator of these requests? Is there some kind of 'debug' for IP traffic where a destination IP can be indicated?

Thanks for your help.

[MHM Cisco World]

meaning one PC in your network have virus send DDoS to ISP ?

[Aleck_Sei]

Exactly!

How (for example through a 'debug' that shows the destination IP of the requests) could I locate the MAC address of that device?

Thank you very much

[MHM Cisco World]

show interfaces | include line | input <<- in each SW, do this three or four times 
check the input traffic for each port which one is increase rapidly, then shut the port and check the DDoS with ISP