Virus in PC

[CSCO10320953]

Multiple switches are interconnected with each other in a large network one PC connected to the switch is affected by virus because of which it is creating problem.how do u identify which switch & port of that switch .....

kindly give step by step process????

[sourabhagarwal]

1. Telnet to the Layer-3 device which is acting as gateway of the PC. you know that what is the gateway IP configured on infected PC, telnet to this IP.

2. Ping IP of PC from the L3 device.

3. enter "show ip arp on L3 device to find out MAC address of PC.

4. enter "sh mac-address-table address to find out the port from which this MAC address is being learned.

5. If port learned is connected to some other switch, login to that switch IP, you can know the IP of device using "show cdp neighbor interface detail" command. Otherwise it will show the interface from which infected PC is connected.

hope it helps ... rate if it does ...

[CSCO10320953]

Actually i dont know which PC is virus affected.How to findout virus affected PC IN LAN

[CSCO10320953]

Hi Sourabhagarwal,

I am waiting your reply

[abhishek_nandavat]

Hi,

If you dont know the IP of the PC which is virus affected, I guess the best way to find out would be by scanning all your systems with an updated Anti-Virus software.

Regards,

AbhisheK

[spremkumar]

Hi

If you are using a router in your network you can enable netflow on the same and find out from which ip you are getting huge chunk of packets.

You can enable the same using ip route-cache flow under the ethernet interface and find out using the command show ip cache flow..

The output will have all the required details like source/destination address with the port numbers too..

You can check out the increase in counters on the packet column which could help you out in finding out the affected PC..

regds

[CSCO10320953]

Thanks for information..