DOS Attcak ???

[afzaalq007]

Hi,,

How can we detect that our Gatway router or Core router is under DOS attack....

and what should be the frist step ater the detection of DOS attack...

Thanks.

[baudhayan]

Try configuring some kind of IDS on your perimeter devices.

[afzaalq007]

Hi,,

Can you tell me with little detail?????

thanks

[baudhayan]

You get various IDS devices from Cisco & other vendors. Just need to google them. Google has everything.

[skarahasan]

Hi,

We use dos prevention mechanism in our FWSM 3.1 by using static nat command. Does anybody know a way of monitoring embryonic connections by some show command and if it is taken into production.

thanks.

[baudhayan]

Try "sh conn". In the graphical interface also u can watch the current connection status...I guess.

[mark.edwards]

You can do a basic monitor/block of Syn attacks using "TCP Intercept" feature under IOS. You can also monitor for sys/fragment/smurf attacks by creating an permit access-list matching the required traffic sype and using the log-input statement at the end.