i have a t1 line sharing a frame relay connection into a cisco 2620xm router. I have about 5 sites that come into the router via frame-relay that use our internet too. I have been having internet issues being very slow lately and have a few static routes configured on the router. I would like something put in place that i can monitor the usage of the traffice (mainley just WAN) so i can tell when we are having a problem and what device it is comming from (ip address/computer name). Currently our intenet is very slow and i keep getting complaints. I would like a solution to this problem as soon as i can.
I keep getting this log on the router:
*Mar 1 05:21:16.766: %FW-4-HOST_TCP_ALERT_ON: Max tcp half-open connections (50
) exceeded for host 203.84.195.1.
*Mar 1 05:21:22.678: %FW-4-HOST_TCP_ALERT_ON: Max tcp half-open connections (50
) exceeded for host 203.84.195.1.
*Mar 1 05:21:39.834: %FW-4-ALERT_ON: getting aggressive, count (89/500) current
1-min rate: 501
*Mar 1 05:21:40.738: %FW-4-ALERT_OFF: calming down, count (82/400) current 1-mi
n rate: 355
*Mar 1 05:22:10.738: %FW-4-ALERT_OFF: calming down, count (42/400) current 1-mi
n rate: 393
SHOW VER:
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-IO3-M), Version 12.2(24b), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Fri 23-Jul-04 21:35 by pwade
Image text-base: 0x8000808C, data-base: 0x80A6D160
ROM: System Bootstrap, Version 12.2(7r) [cmong 7r], RELEASE SOFTWARE (fc1)
Tabor_Main uptime is 6 hours, 24 minutes
System returned to ROM by reload at 15:40:51 UTC Tue Aug 8 2006
System image file is "flash:c2600-io3-mz.122-24
cisco 2620XM (MPC860P) processor (revision 0x100) with 126976K/4096K bytes of me
mory.
Processor board ID JAD07090BMB (1492618591)
M860 processor: part number 5, mask 2
Bridging software.
X.25 software, Version 3.0.0.
1 FastEthernet/IEEE 802.3 interface(s)
1 Serial network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read/Write)
Configuration register is 0x2102
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I don't know what the 203.84.195.1 IP address is, our ip range is 204.26.6x.xxx. How do i switch on ip-accounting? For the software to use, i want to get detailed information on actual IP address taking up the bandwith and as easy to use as possible since im new to the software. Most of the software i have looked at gives me a graph of general usage, but i want detail of devices on the network taking up the bandwith. Would you recommend I install this software on a dedicated device or should i just put it on one of our servers or local pcs? Do i just need to setup SNMP on the cisco to use this software? If so did i do it correctly?
on my device:
snmp-server community mypassword RO
snmp-server chassis-id JMX0000000
snmp-server enable traps tty
Okay, if you want to see source ip address and bandwidth then you'll have to go for NTOP.
http://www.cisco.com/en/US
Here is something that tells the technology in detail and software that you can use to collect those details.
Cheers,
Rajesh
thank you all for your help- after i enabled ip accounting and setup SNMP i was able to track my high traffic areas. The problem was i had port 25 opened on one our our webservers and TONS of overseas places were connected to it sending out SPAM, very frustrating but as soon as i turned it off, it was like instant fix. Thanks again!
Business Accounts
Answer for Membership
by: mohawk1Posted on 2006-08-09 at 07:38:59ID: 17279294
Hi,
Just decoding the messages for you:
1. %FW-4-HOST_TCP_ALERT_ON: Max tcp half-open connections ([dec]) exceeded for host [IP_address].
The max-incomplete host limit of half-open TCP connections has been exceeded. This message indicates that a high number of half-open connections is coming to the protected server, and it may indicate that a SYN flood attack is in progress and is targeted to the specified server host.
Recommended Action: This message is for informational purposes only, but it may indicate that a SYN flood attack was attempted. If this alert is issued frequently and identified to be mostly false alarms, then the max-incomplete host threshold value is probably set too low, and there is a significant amount of legitimate traffic coming into that server. In this case, the max-incomplete host parameter should be set to a higher number to avoid false alarms.
Related documents- No specific documents apply to this error message.
2. %FW-4-ALERT_ON: [chars], count ([dec]/[dec]) current 1-min rate: [dec]
Either the max-incomplete high threshold of half-open connections or the new connection initiation rate has been exceeded. This error message indicates that an unusually high rate of new connections is coming through the firewall, and a DOS attack may be in progress. This message is issued only when the max-incomplete high threshold is crossed.
Recommended Action: This message is for informational purposed only, but it may indicate a security problem.
Related documents- No specific documents apply to this error message.
It looks like something is trying to hack you. Switch on ip-accounting initially.
Regards
Mohawk1