fullerms
asked on
Checking for half open connections
Hi,
This is really an extension of my previous post. I managed to track down the issue behind high cpu utilization, which was indeed caused by a worm. The worm caused a lot of hosts to open and terminate connections to our servers, leaving them in the TIME_WAIT state. Some hosts had opened thousands of connections to the servers.
How do I track down these half-closed connections on the firewall? A "show conn " gives out a lot of detail. What do I need to look for?
Second question.
While I was trying to track down the infected hosts using a sniffer, a vendor suggested that I use the MSFC on the core switch as a source and filter it on the specific VLAN. How is this different from port mirroring?
The commands I used were
MSFC sniffing ----> set span (msfc) (destination port) filter (vlan_number)
Port sniffing ----> set span (vlan_number) (destination port)
Each of these methods threw up a completely different set of statistics. What is the difference?
This is really an extension of my previous post. I managed to track down the issue behind high cpu utilization, which was indeed caused by a worm. The worm caused a lot of hosts to open and terminate connections to our servers, leaving them in the TIME_WAIT state. Some hosts had opened thousands of connections to the servers.
How do I track down these half-closed connections on the firewall? A "show conn " gives out a lot of detail. What do I need to look for?
Second question.
While I was trying to track down the infected hosts using a sniffer, a vendor suggested that I use the MSFC on the core switch as a source and filter it on the specific VLAN. How is this different from port mirroring?
The commands I used were
MSFC sniffing ----> set span (msfc) (destination port) filter (vlan_number)
Port sniffing ----> set span (vlan_number) (destination port)
Each of these methods threw up a completely different set of statistics. What is the difference?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
> .. how do I check for half open connections on the firewall?
read your docs of the firewall. There is no general answer, it's specific to your firewall.
read your docs of the firewall. There is no general answer, it's specific to your firewall.
ASKER
The firewall is a Cisco Pix v 6.3(3).
ASKER
I wouldn't like to be called a miser, but I feel that a refund would be more appropriate. I did not get the answer that could have helped me.
You were pointed in the right direction what to read. You never said if you checked your documentation...
ASKER
My question is, how do I check for half open connections on the firewall? At any given point of time, the firewall is handling 3 times the normal number of connections. We need information on half open connections to track down the offending IPs. How do I go about this?