Cisco 805 - 100% Utilization

[LoveM]

Hi,

Before I go any further I must state, that I know NOTHING about the Cisco 805 Router.

We have an 805 router which is connected to our ISP via a least line.

For some strange reason since yesterday at about 6pm the internet traffic has been a constant 100%.

Is there any whay I can see what is happening on the router. I have asked everyone if they are downloading anything from FTP, but everyone has said that they arn't.

According to our on-line stats for our ISP it's traffic coming into our company.

Thanks in advance;

Martin

 

[BOJIKA]

IIS + code red

 

[LoveM]

Thanks for the answer Bojika, but could you please be a bit more specific.

Are you talking about the Virus, if so. I have CA InoculLan with the latest updates on all of our servers.

Thanks.

 

[wybnormal]

What he means is that your router may be getting hit by all the port 80 scanning requests from infected PCs.. this would only be true if your router is blocking the requests either through an access list or you have some firewall software setup on the router.

Other sources of CPU hogging..

bad route tables using OSPF or EIGRP (BGP would not apply here)
ARP storm from a local PC or print server
out of memory for some reason on the router
Link congestion

Mike S
Find me at

http://www.packetattack.com

"Diplomacy; the art of saying 'nice doggie' till you can find a rock" Wynn Catlin

 

[marsd]

The arp storm is part and parcel of the code red deal.
arp whohas ?
running tcpdump on my l'ix box I can watch my webserver get pounded.
If anyone is interested I wrote a little pice of code that will parse an apache log file for nimda/code red entries and it would be easy to feed the output to a packet filter-
some of the attackers/infected boxes are pretty amusing.
it is in the linux server forum.

 

[LoveM]

Thanks for the replies, but what I'm looking for is commands or something that I can use on the router to see exactly what it's doing. What traffic, where it's coming from etc.

I have checked all the pc's and servers and they seem to be virus free.

Thanks again.