How to detect DoS attacks on IOS Firewall

[pambosch]

We have several remote sites having a 2610 router with IOS Firewall software implemented. Sometimes the internet connection on these sites gets really slow, and also the VPN traffic coming from the remote sites to the central one is delayed A LOT. I am wondering if I\m under DoS attack some times, but I don;t know how to detect this attack. What command should I use on the router to verify if I am under attack?

Thanks

[rgrcommo]

You just need some access-lists and some rate limits set on your interfaces.

you can use IDS but consider the memory usage and performance impact on the routers along with signature coverage and signature updates..

I would just add some access-lists and do the rate-limit on the int's needed.

Here is a good link to help you out.

http://www.cisco.com/warp/public/707/newsflash.html

-jambrose