Detect DDOS attack?

[tinhnho123]

Hello guys,

I have an ASA 5550 for 3 years, it's been working great. I was wondering how do I detect if I'm under DDOS/SYN attack from my ASA (ASDM or CLI)? How to mitigate the attack? Thanks.

[Michael Muenz]

ASA has basic threat detection features (ASDM -> Config -> Firewall -> Threat Detection) where you can configure it (SYN attacks). DDOS is not very specific because there are many variants of it, currently most of it are DNS attacks

Michael

Please rate all helpful posts

[tinhnho123]

I have those enabled now. I've heard a lot about DNS attacks but what exactly ASA can do to migitate it? if not what can I do/buy (I've heard of IPS module for ASA) to migitate it if it happens? Thanks and have a good Friday!

[Michael Muenz]

http://www.prolexic.com/

Michael

Please rate all helpful posts

[Anthony.Herman]

There are a lot of companies that specialize in Netflow products speficially tailored towards DDOS detection.