Suspect on router under attack.

[laimf]

Hi,

Would appreciate if someone could advise on how to check if the router is under attack, eg. any useful show commands that can provide indication of router undere attack? If I have a 128K leased line connection with only few users doing email thing, but spike of high traffic load are seen on the interface, would it be indication of attack?

Thanks alot,

M.Fun

[jmia]

Hi Moh,

With the issues of Cisco IPv4, please read the following URL and see if this relates to your problem:

http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml

Thanks - and let me know how you get on.

[osam]

Take a look at these links too... (I would consider these the most common and important security documents in Cisco site)

http://www.cisco.com/en/US/tech/tk583/tk385/technologies_tech_note09186a0080149ad6.shtml

http://www.cisco.com/en/US/tech/tk583/tk385/technologies_white_paper09186a0080174a5b.shtml

and

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml