6500 and DOS

Start with Cisco doc

Protecting the Cisco Catalyst 6500 Series Switches Against Denial-Of-Service Attacks

One of the first things I would suggest is that the 6500's be migrated to native IOS mode.

Just need something to show IP being targetted inbound or outbound and by whom?

Gary

Depending on the volume of traffic one thing that can be done is to use the SPAN fetaure to set up a monitoring port for the interface(s) over which the 6500 receives Internet traffic.

Coonect a PC with Etherreal installed and run a capture. Then use the analyse report that show connection endpoints.

You could alos look at enabling NETFLOW accounting whic will show source and destion IP address and port numbers.

NETFLOW osunds good. Is it a big overhead and how do I enable it.

start with

Please post show version and show module for the 6500 switch facing the Internet.

It has a Supervisor Engine 720 (Active) WS-SUP720-3BXL, WS-F6K-PFC3BXL, MSFC3 Daughterboard

If you let me have the commands I can test - TIA Gary

excellent !!!

what IOS version ???

Hopefully this will get you started

! Configure NetFlow on 6500

! 1. enable NetFlow on PFC

mls netflow

! 2. config the type flow mask to be used by NetFlow

mls flow ip full

! 3. display NetFlow flowmask configured

sh mls netflow flowmask

current ip flowmask for unicast: full current ipv6 flowmask for unicast: null

! 4. check NetFlow cache aging timers

show mls netflow aging

enable timeout packet threshold ------ ------- ---------------- normal aging true 300 N/A fast aging false 32 100 long aging true 1920 N/A

! 5. display NetFlow accounting infomation for traffic switched by PFC

sh mls netflow ip any

Displaying Netflow entries in Supervisor Earl DstIP SrcIP Prot:SrcPort:DstPort Src i/f :AdjPtr

----------------------------------------------------------------------------- Pkts Bytes Age LastSeen Attributes

---------------------------------------------------

For configuration of NetFlow sampling see :

Worked a treat!

What is the overhead during a DoS

Thanks Gary

For packets forwarded by the PFC-2 and PFC-3, Netflow statistics are

However, table maintenance, i.e. aging out old entries, and possibly exporting them when NDE (Netflow export) is enabled, does use CPU cycles. That is particularily noticeable when there is a high number of flows, as is seen during aggressive port scanning or some kinds of DoS.

PFC (MLS) Netflow table maintenance is mostly done by the Switch Processor on the Supervisor, not by the Route Processor (MSFC). NDE (Netflow export from the PFC) used to load the MSFC somewhat, but since or 12.2SXE (I think), NDE is done entirely by the Switch Processor.

There is an upper limit on the amount of maintenance work for MLS Netflow, because the table is "walked" at a fixed rate (~32K entries every second, I think). Therefore I don't think you need to be worried that a flow-heavy DoS may bring your box down. I think there may be small issues for things like reading interface counters when the Switch Processor is heavily loaded, but everything else should work just fine.

Because the PFC/MLS Netflow table has a fixed size (128K entries on the PFC-2/PFC-3, 256K on the PFC-3BXL), and aging out old entries is done on a fixed schedule, the hardware Netflow table will run full when there are too many flows. This just means that some packets cannot be accounted for in Netflow.

We actually had to upgrade all our MSFC2 boxes to SUP720's because NDE caused the CPUs to spike to 100%. There were no impact to traffic being switched, but core routers running at 100% is never a good thing!