the new virus and growing packet stream 1

[ninghi]

with breaking out of the new virus,my network's packet stream growing heavly,many users'connecting rate turned slow, I want to know how to solve the problem

 

[ForceMajuere]

Hi Ninghi,

Which virus?

I have seen the W32.Blaster.Worm cause an ARP request storm on a network as all the infected hosts search for other hosts to infect.

The solution is simple! Disinfect all the infected hosts! Run regular updates on your OS's. Install a firewall!

HTH

Force Majuere

 

[trojan2003]

Check Symantec website (

http://www.sarc.com)

for tools to scan recent worm, W32.MSBlaster and W32.Welchia.

If u are looking at blocking the worm on your network, visit Cisco site for some solution.

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00801b143a.shtml

Best solution is still to patched affected PCs or Servers.

Good luck!!

 

[StarTAC]

use access lists to block the traffic being generated by these worms, into and out of your network..

check Cisco's advisory board for more information..

good luck..

 

[sudhakarraj]

Hai!!!!!!!!!!!

This could be because of new worm(Nachi) spread overs the NET.Pls go through that site

http://www.cisco.com/go/psirt

Cheers
HariSudhakar

 

[sutini]

Go to Microsoft to download latest patch for NT,Win2k etc..., and apply them. Download also MS scanning tool to scan for unpatched hosts.It doesn't end here.

Go to Virus protection software site, download latest update engine/signatures, scan and clean and ensure that PCs/Servers are virus-free. McAfee have downloable Stinger program to detect latest worms like Nachi,Mblast,SoBig,Lovesan.

For Router:
1) First use ACL to block ICMP,apply to Inbound in order to minimize infected hosts from spreading virus, indicated by high CPU usage.
2) Activate "ip route-cache flow" to incoming interface(IOS 12.0 and above). Globally use "ip cache-flow feature-accelerate" to optimize process.
3) Do sho "ip cache flow | include 0000 0800" (to see hosts doing ICMP pings to scan for vulnerable PC/Servers on MS OS).
4) Refine ACL to block ICMP and vulnerable tcp/udp ports like 135,139,445,707,4444. Filtering these ports can also disable some valid MS services.

Couldn't recall all URLs but a google search for the above will find them one way or another.

Hope it helps.