| Author |
Nimda and CPU utilization
|
|
| The Reamer 2001-09-18, 7:14 pm |
| Hey gang,
Just wondering if any of you have encountered this new worm yet and what you are doing to fight it so far. Got a customer that is having CPU utilization issues. Running at 94%. Just can't pinpoint a single source for the traffic. Still fighting though. 
Reamer | |
|
|
| The Reamer 2001-09-18, 8:12 pm |
| We've directed the customer to the same links since it is not our responsibility. I just wanted to let everyone know that you might be infected if you are having issues with CPU utilization.
Thanks again,
Reamer | |
|
|
|
| setup an accesslist such as follows:
access-list 171 deny tcp any any eq www log
access-list 171 permit ip any any
access-list 171 permit icmp any any
this will settle the router down and inform you of infected hosts. See you need to block hosts sending traffic over http<<< youll be able to see wether its regular traffic or if its traffic from an infected host. Remember this access-list must be applied on the lan segment, and will stop all WWW traffic, so if there is business critical sites that must be reached by internal clients than just add a permit statement for that 1 addreess.. This should help you. Believe me its the only way to save your cisco gear from crashing.. The log is very important. once you apply the list, from privelaged mode type (term mon) this will show you all the hosts hitting your access-list. Type (term no mon) to stop messages on your console.
hope this helps. | |
|
| For complete that is said before:
Do you have "ip accounting output-buffer" on your interface for get the couple of address which discusses the more ? (I Know, you have 94%, nevertheless you can try the "ip acccount" on the good interface) and after that create the good access-list (as suggered by "007").
I don't know your topology, your IOS relase nor your configuration.
I suppose that your system is not busy because the traffic is high.
When I get 90% cpu use, often that comes from to broadcast loops, or bridging loops, or debug command.(I suppose you master the"sh interfaces" and look for if the number of broadcast is increasing".
hope this helps so. |
|
|
|
