Hello,
Im looking for a way to mitigate TTL Expiry attack on a Cisco 4948-10G.
I've been googling around for hours, however, havent yet found a way to do it :(
Does anyone know a workaround to match low TTL packets?
Currently routing low TTL packets and generating ICMP replies fully occupies the CPU :S
Thank you in advance!
Bests,
Semirke
More info:
The switch is running Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-IPBASEK9-M), Version 15.0(2)SG9, RELEASE SOFTWARE (fc2)
when I try to add a TTL ACL, I got no such option:
me(config)#access-list 100 deny ip any any ?
dscp Match packets with given dscp value
fragments Check non-initial fragments
log Log matches against this entry
log-input Log matches against this entry, including input interface
option Match packets with given IP Options value
precedence Match packets with given precedence value
time-range Specify a time-range
tos Match packets with given TOS value
<cr>
