Cisco ASA Syslog meesage id for Distributed Denial of Service (DDoS)

[shalendra2]

Hi Team,

               We want to analyze syslog messages for Distributed Denial of Service (DDoS) attack. Only DoS attack related message ids are there in Syslog message guide.

Please suggest the messages ids for DDoS.

-Shalendra

[Marius Gunnerud]

DoS and DDoS will essentially have the same syslog message ID, DDoS just refers to how the DoS attack is executed.

--

remember to select a correct answer and rate helpful posts

[shalendra2]

Agree Marius! But i'm looking for specific DDoS message Ids and in message description it should say for DDoS attack only.

-Shalendra

[Marius Gunnerud]

As far as I know the ASA does not provide any logs that specifically state DDoS.  If you want this you will need to invest in an IPS and look for matches on signature ID 1493/0.

--

remember to select a correct answer and rate helpful posts