Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Unicast Packet Storm Blocking on Cat IOS and IOS

Does the "Storm Control" feature help in blocking sudden attacks from a specific port?

Scenario:

One person in one classroom in one building coming back to a switch (2948 or 2900XL) is flooding the network with zillion bits per second. He has a virus and doesn’t know he is sending that many packets per second and bringing down the entire network. Can I block this traffic with the “Storm Control” feature at the port level (or even the uplink) so it block the port until it reaches a normal threshold again? These are not broadcasts, but unicast packets. Any suggestions are welcome. Thanks you.

7 REPLIES
Bronze

Re: Unicast Packet Storm Blocking on Cat IOS and IOS

Looking at the following document on CCO

http://www.cisco.com/en/US/products/hw/switches/ps607/products_command_reference_chapter09186a008007e90c.html#xtocid1214010

Storm control only works on broadcast traffic.

You can use the port block unicast interface command to block unicast but it does not allow you to set threshholds.

Community Member

Re: Unicast Packet Storm Blocking on Cat IOS and IOS

Thank you.

So with "port block unicast" I can block flooding of UNKNOWN packets. However, with virus attacks like the slammer worm on SQL, where a machine floods the newtwork with known unicasts, that commands does not help, right?

What about rate-limiting based on VLANs?

Thanks,

Marcelo

Re: Unicast Packet Storm Blocking on Cat IOS and IOS

IMHO, your info is obsolete.

It should be possible to control unicast storms with the latest IOS.

See http://www.cisco.com/univercd/cc/td/doc/product/lan/c2900xl/29_35wc6/cli/clicmds.htm#xtocid69 for details.

Regards,

Milan

Community Member

Re: Unicast Packet Storm Blocking on Cat IOS and IOS

would this work with any type of unicasts, including known and unknown packets?

Re: Unicast Packet Storm Blocking on Cat IOS and IOS

I think it should.

If you have any doubts, test it.

Put one switch to a lab network, connect two PCs to it, set an extremly low threshold for unicast storm control, start some traffic between the PCs and observe if unicasts are dropped or not.

Regards,

Milan

Community Member

Re: Unicast Packet Storm Blocking on Cat IOS and IOS

I tested it, and it does work. Too bad I don't have a feature like this on my 2948/80G swicthes :(

Community Member

Re: Unicast Packet Storm Blocking on Cat IOS and IOS

Is there a way to perform the same blocking for a entire switch at once, or from the router ?

Thanks,

200
Views
0
Helpful
7
Replies
CreatePlease to create content