Re: Track the SYN attack from a particular host

From: John Edgmon (jcedgmon@gmail.com)
Date: Tue Jan 09 2007 - 12:45:49 ART

source tracker:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120limit/120s/120s21/ipst.htm

On 1/9/07, Ricky MK Au <aurmk@hk1.ibm.com> wrote:
>
> Dear all,
>
> How can we track if there is any SYN attack to a particular host? The
> question is as follows.
>
> It is suspected that there is a SYN attack from a particular IP address.
> Configure the router to track all the attack and log them into the syslog
> server. Please do not use any ACL to achieve it and the logging only
> performed one time per day.
>
> Is anybody can help? Can I use ip tcp intercept?
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html

This archive was generated by hypermail 2.1.4 : Thu Feb 08 2007 - 23:46:56 ART