08-22-2003 11:52 AM - edited 03-02-2019 09:49 AM
Dear All,
I have 2 links to the same ISP from my main router and is distributing traffic through that router to my network for which I run OSPF. My problem is that , I see abnormal traffic in my serial interfaces.Around 500Kbps more than the real traffic to my IP ranges in my network. The traffic seems to be like ICMP , I mean 500 K more outgoing and 500 K more incoming through the serial interfaces.The traffic does not get in to my network.Its visible only in the serial interfaces.Thats why I said its something of the nature of ICMP.
I have 4500 series router and I tried upgrading my IOS to 4500 Enterprise edition.But still the problem persists.
Could anyone who have faced similar scenario help me out and suggest what could be the possible reason behind this.
Thanks in advance.
Homin
08-22-2003 09:24 PM
hi
try the ACLs provided by Cisco Security advisory related to Nachi/Blaster worm.
http://www.cisco.com/warp/public/707/cisco-sn-20030820-nachi.shtml
http://www.cisco.com/warp/public/707/cisco-sn-20030814-blaster.shtml
regds
prem
08-24-2003 11:29 PM
Thanks Prem . It was the nachi worm that did the trouble. I have put the PBR and the traffic has come down. I am now watching the proceedings closely.
Thanks again for your valuable piece of information
Rgds,
Homin
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide