Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

DOS traps from CSS - can we see source IP in trap ?

Hi everyone,

regarding DOS attack traps generated from CSS,

is there way to put more info in the message,

like source IP of attacker that caused the trap ?

I can see some source IPs in "sh dos" output,

but it hard to find the latest events/IP in the output

Currently I am getting just number of SYNs and time stamp in the trap

regards,

Alex

2 REPLIES
Silver

Re: DOS traps from CSS - can we see source IP in trap ?

Cisco Employee

Re: DOS traps from CSS - can we see source IP in trap ?

set the flowmgr logging level to debug and you should see something like this in the log :

13 DEC 11:45:43 3/1 18 FLOWMGR-7:

DoS SYN attack: 20.20.20.20:4000->192.168.20.222:81

synCnt: 1, initSeq: 776425626

Gilles.

175
Views
0
Helpful
2
Replies
CreatePlease login to create content