Question about "IDS, DNS Attacks graph"

[zacca]

Hi there,

From my PIX506 PDM, I plotted a graph "IDS, DNS Attacks", in which I got a blue line keep on raising up to 6K packets. From the legend blue line is "All Records".

I got a DNS server behind PIX which allow for public access, is this blue line a normal one? Or it really told me that my DNS server was being attack? If it was really being attack, how can I retrieve more info from PIX?

Thanks so much for your help!

 

[agrigorof]

Have you configured your firewall to report to a syslog server (i.e. Kiwi syslog)? If yes, parse those syslog servers and see the details about the IDS events. Use a log anlayzer (wink, wink) to look for the details that you are interested in.

Adrian Grigorof

http://www.eventid.net/firegen/firegenpix2.asp

FireGen for Pix Log Analyzer