cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
229
Views
0
Helpful
1
Replies

Logging DOS, scan activity in a PIX?

vladrac-ccna
Level 5
Level 5

I need to gather the following information from a PIX log.

•machine scanning—scanning a network to see the machines it contains

•port scanning—scanning the ports on a machine to see the running services

•port overuse—the abuse of a service offered by a particular machine

•too many accepts, rejects or drops— for instance, users receiving persistent denials of service

•oversized data transfers— for instance, excessively large FTP transfers

what do I need to set on the PIX to send this information to logging server.

Ive read that I can do this using cisco info center, but only with SUN?

can I do this using linux? is there a way to implement this on linux?

Please help.

1 Reply 1

a-vazquez
Level 6
Level 6

This chapter lists the PIX Firewall system log messages. The messages are listed numerically by message code.

The messages shown in this guide only apply to PIX Firewall version 5.3 and later. When a number is skipped from a sequence, for example, 106004 or 110001, the message is no longer in the PIX Firewall code.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v53/syslog/pixemsgs.htm

Review Cisco Networking products for a $25 gift card