Cisco IPS ... am I under attack?

[nmessick]

I setup IPS today and started seeing several counters running. an ICMP DOS attack, Half open Sync, DNS limited broadcast.... this connection has never been right and I've made dozens of confieration changes that never really set things right. could I be onto somthing here? What do you do with this stuff... there is not much documentation on each type of attack.

 

[jeter]

So what are you doing about it? Firewall, access-lists, etc etc. Have you analyzed the network using something like wire-shark?


Go Army!
Tek-TIP Member 19,650

 

[burtsbees]

Is it syslogging? If so, post the output, or a sh logg

/