TCP attacks

[hggalurajr]

Hi I am trying to troubleshoot a TCP attacks problem. Here is the following message: %TCP-2-TCP_MAXESTABLISHED:Possible TCP ACK attack. Maximum established connection limit 64 reached. Will drop unused connection.

I know in LINUX there is a command to find out where open connections are coming from, I was wondering if there is a similar command for Cisco IOS? Thanks for the help.

[hggalurajr]

The OS running is CatOS.

[Kevin Dorrell]

Try show users. It works on my CatOS boxes - 8.4(5)GLX.

Kevin Dorrell

Luxembourg

[shwetabohra_mca2005]

hi,

i'm facing the same problem can u tell me what is the command in linux b'coz i'm working on a linux server...

thanks for help

[cjunhan01]

You may want to turn on NAT debug mode:

ciscorouter> enable

Password: ********

ciscorouter#term mon

ciscorouter#debug ip nat detailed

IP NAT detailed debugging is on

ciscorouter#

03:29:49: NAT: creating portlist proto 6 globaladdr 97.158.253.26

03:29:49: NAT: Allocated Port for 192.168.1.100 -> 97.158.253.26: wanted 80 got 80

03:29:49: NAT: o: tcp (198.133.219.1, 5698) -> (97.158.253.26, 80) [0]

Regards,

Junhan