viruses remaining on router interfaces?

[geranimo666]

Hello-

Is it possible at all for a DoS and(or) virus to exist on a router interface and just the interface?

Causing the interface to remain saturated and congest it?

Any info would be great... some pointers on what to do about this -perhaps a sniffer to run on the switch the router is plugged into?

thanks for any info at all

geranimo

 

[burtsbees]

What exact problems are you having? Can you post a sh int of the interface in question?

Burt

 

[vipergg]

The answer is no but a device that is infected could be flooding that interface causing basically a DOS . If it was something like that then it is almost always a device out on the network.

 

[geranimo666]

vipergg-

There are lots of CRC's and some FCS issues on the 3740 serial and multilink interfaces.. whats the right command to clear the counters.. haven't tried that yet.

any ideas?

thank you for your feedback

geranimo

 

[vipergg]

Just a "clear counters" command will clear the interface statistics.

 

[vipergg]

Look for steadily incrementing errors on the serial interface , if so then this is a line problem and would go the carrier to look at this . Look at the actual loads on the interfaces , do a "show interface " and look at the load parameters , they should show as x/255 . If it is saying 250/255 then the line is basically saturated , if says something like 10/255 then that is nothing . Just divide it out the load it is a percentage divided by 255 such as 240/255 is about 94% utilization .

 

[geranimo666]

thank you vipergg,

this is valuable info

have a great weekend!

geranimo