Hi Kent,
Will IP accounting halt the router given 50Mbps of traffic passing through?
regards,
andy
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
[EMAIL PROTECTED]
Sent: Wednesday, June 06, 2001 5:24 AM
To: [EMAIL PROTECTED]
Subject: Re: Dos Attack [7:7049]
Andy,
1) Enable IP accounting on the router interface "closest" to the
traffic in question. Watch the output of "sh ip account" and you
should be able to tell fairly quickly what the originating IP address
is of the offending station
2) Now you have the IP, you know which segment the station is on,
look at the local router's arp table to determine the MAC address
3) Look at the switch(s) to find the port the MAC is on and then
trace to the physical station and investigate
Regards,
Kent
On 4 Jun 2001, at 8:03, Andy Low wrote:
> Hi,
>
> If there is a machine within my network generating high load of
> traffic, how can I detect the machine asap?
>
> I have cisco 7507 routers and catalyst 5509 switches. Which command
> should I use to check? On the catalyst switch which command can I use
> to find out port the machine is plugged to?
>
> Thanks
>
> Andy
> Nondisclosure violations to [EMAIL PROTECTED]
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=7296&t=7049
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
