how to identify a DDOS attack

[mickyq]

Hi

I have a suspected DDOS attack goin on. Ive got a 5550 with software ver 8.0

Im looking for tcp sessions whitch dont complete the setup.

Im using the show local-host command but theres a lot of output to read through. Is this the best way to try and identfy tcp sessions.

In output: TCP flow count/limit = 3/unlimited

What would be considered abnormal?

Any help, command or advice would be appreciated.

thanks

[pantelis1]

Hi

It kind of depends on what kind of DDOOS /DOS attack you think you are getting. For example do you a abnormal number of high embryonic connection?

sh local-host | inc embryonic

By default value is zero (unlimited connections)

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/s1.html#wp1424045

You can configure such limits as described : http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_connlimits.html

Thanks

Pantelis