Help! Attacked? Very slow downloads... 1

[Solo4357]

I have a problem with my internet today. I have a PIX 515e and I suspect an attack, however it could be some moron downloading god knows what. What's the best way to see what the current connections are and how much they've used?

I have network monitor with SMS but I'm unclear if it can help. I'm open to using the command line or getting new software, I just need to figure out what the heck is eating my bandwidth. I have a 2600 router in front of the firewall. Any help would be great.

 

[lerdalt]

I don't have any experience with the PIX, but would assume you can get some flow information from it. Otherwise I'd look into enabling netflow on the 2600 and watching top talkers with it.

 

[Solo4357]

what's the best way to do that? I have done a lot of configs but not a lot of monitoring on routers...

 

[lerdalt]

This will probably do a better job then me trying to explain it.

http://www.cisco.com/en/US/docs/ios/12_2/switch/configuration/guide/xcfnfc.html

 

[burtsbees]

Or Ethereal/Wireshark. Also, sh int on the PIX and router and post the results. Do you have any action-alarm or aaa audit trail commands in the PIX, or maybe even a syslog server for the PIX and/or the router?

Burt

 

[Solo4357]

I don't. However I was able to go to my internal router and do the route-cache flow on my ether interface. Figured it out pretty quick after that. Thanks for all your help!

 

[lerdalt]

I can't count the number of times that having netflow and the top talkers enabled on my routers has saved my butt. Of course, like burt pointed out, I don't think there is any substitute for a packet analyzer.

I've been able to take netflow and analyzer information back to other groups and ask what it is they are doing to the network and if I need to start blocking things.