VIRUS INFO FROM CATALYST LAYER 3 switches

[r.kate]

Hi ,

If i do show arp nat translation * on the router I can find the IP address of the machine that is doing the icmp flooding to other machines .Is there a similar thing on the switches 4006 layer 3 where i can find machines which are generating lot of icmp traffic across vlans .

Any help appreciated .

thanks

Raj

[a.seetharaman]

Hi,

ou can enable netflow or IP accounting on the VLAN interfaces to get these informations. Please find below the URL to have a look at the security advisory published by cisco, where it explains on how to find out whether any virus attack is happenning.

http://www.cisco.com/warp/public/707/cisco-sn-20030814-blaster.shtml