Syn attacks

[k.heselmans]

Is there a possible other way beside CSS switches and rate-limits on the router to prevent Syn floods on our internet uplinks/Transits?

A Pix is not in the picture yet:)

[ciscomoderator]

The focus of this board is Virtual Private Networks, however, there are a number of professionals online who may be able to assist you.

If you don't get a suitable response to your post, you may wish to reveiw this document on Cisco.com:

http://www.cisco.com/warp/public/707/4.html

If anyone else in the forum has some pointers, please reply to this thread.

Thank you for posting.

[brian.perry]

An ACL on your head-in routers? We use CSIDS (Netranger) to detect and apply ACLs dynamically. Its good for syn floods and such, not so good for more complex stuff, Unicode, etc., we have to depend on Cisco for the signatures, ...but then again, there is no perfect IDS.

[richard]

We've implemented the NetRanger, but had some difficulty with ACL updates, i.e. the Device Management Module. I would really be interested in how you find the ACL updates working for you?

What is your experience with the Netranger signature update frequency and completeness?

Thanks for any info.