Aside from LAN virus scanners and Intrusion Dection Systems (IDS), I'm not aware of any specific tool that would help.
You generally have to chase a few symptoms, for example:
If you find that you cannot connect via telnet, ssh, or console ... one of the chief suspects is a worm / virus / trojan. If you can disconnect one of the high-speed interfaces and get in, you almost certainly have a bug. This is because the router's priority is to move packets ... not handle the console.
Other symptoms are primarily statistic related ... looking for high cpu loads (sh proc cpu), high buffer utilization (can be congestion at the far end as well - sh buffers), and, if you're NAT'ed, an extremely high translation count ... usually from only a couple sources to one or two destinations and the same port numbers.
The basic guideline is to monitor the dynamic resources and investigate numbers that are high. Removing the / a LAN interface should cause the numbers to drop radically.
Note: Users that are using a streaming service like BitTorrent or KaZaa can also put an ugly load on the network - the applications put themselves into "server mode" and begin to suck up bunches of bandwidth (all that you have, if they can).
Your best defense there is to make sure the network use policy has those topics covered, track down the offending IP addresses, match up the MAC addresses on the switches (ARP / CAM tables), then beat the crap out of the users that are sucking up all the bandwidth.
Route cache is a mechanism to speed up the passing of traffic through the switch / router.
The traditional process is to send the inbound traffic to the processor, who does the route evaluation and disposition of the packet.
With a route cache, once the traffic has been evaluated the forwarding parameters are stored (usually until some definable timeout) and any additional packets received from the same source, to the same destination, using the same ports, are sent on according to the information stored in the table (no direct processor intervention).
The lookup process is much quicker than a process evaluation and can be handled by a co-processor or ASIC.
FWIW
Scott
