DOS traps from CSS - can we see source IP in trap ?

[a.gesse]

Hi everyone,

regarding DOS attack traps generated from CSS,

is there way to put more info in the message,

like source IP of attacker that caused the trap ?

I can see some source IPs in "sh dos" output,

but it hard to find the latest events/IP in the output

Currently I am getting just number of SYNs and time stamp in the trap

regards,

Alex

[carenas123]

This URL should help you:

http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_500/reln5b20.htm#xtocid5

[Gilles Dufour]

set the flowmgr logging level to debug and you should see something like this in the log :

13 DEC 11:45:43 3/1 18 FLOWMGR-7:

DoS SYN attack: 20.20.20.20:4000->192.168.20.222:81

synCnt: 1, initSeq: 776425626

Gilles.