Virus Attack On Cisco Routers

[walesman]

Hi

Had any one had any problems with there Cisco routers since this outbreak of the Nachi virus. We have had 2 Cisco 3600 go down with overloaded arp tables. And then you can tlog on to them and no no traffic flows. Afer they have been turned off and back on again they work for about 20 minutes then the same happens.

Thanks

 

[steine]

Disable all icmp or icmp packets that are 92 Bytes long
since the majority of the packets are 92 bytes long ICMP Echo Requests, and install a linux box with tarpit
and route all unused subnets to that box. That should help some.

http://www.securityfocus.com/printable/infocus/1723

Fredrik
Network Engineer

http://www.mikro-data.net

 

[dx1]

You can use PBR or ACLs to contain the worm. See link for more info:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00801b143a.shtml

Then you will need to identify the hosts and patch them. There's a lot of tools that will allow you to scan your subnet and ID the hosts that are not patched.