Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

TCP Intercept causing high CPU utilization

Hi,

Had a synflood attack and it cause my router to high high CPU utilization... However if i remove the ip tcp intercept, then the CPU utilization is fine... Any solutions for this?

Thanks,

Steven

5 REPLIES
Silver

Re: TCP Intercept causing high CPU utilization

Your router has more work to do when it is being attacked. If it deflected the synflood attack, what is the real problem? You could replace it with a more powerful router, but how often do you expect to get syn flooded?

Community Member

Re: TCP Intercept causing high CPU utilization

how can i stop or block the syn flood? i hope to block a syn flood to my customer server but if i use the "ip tcp intercept", it only cause my router to reach 100% CPU utilization and the syn flood to my customer's server continues...

Community Member

Re: TCP Intercept causing high CPU utilization

You could try one of the other firewall features e.g. IDS or CBAC. IDS is really the ideal one for this situation but much more complicated to implement than TCP Intercept.

Community Member

Re: TCP Intercept causing high CPU utilization

but IDS is meant for monitoring only rite? how can i stop synflood?

Community Member

Re: TCP Intercept causing high CPU utilization

yes, IDS is usually intended to 'sniff' malicious traffic and 'normally' does not have the capacity to 'stop' the activity. however, there are Cisco devices that are capable of dynamically applying a 'shun' of the offending IP addresses when triggered by an IDS event.

you really should either be upgrading your router to a more robust and capable hardware, however, the CPU issue will not necessarily go away. it is a router and not a firewall. a dedicated firewall will handle these attacks more reliably and with greater precision.

there is a feature called 'embryonic limit' in a PIX firewall that works very well for these types of attack. other security vendors offer similar 'SYN Blocking' features so look around.

373
Views
0
Helpful
5
Replies
CreatePlease to create content