external/ios-ddos-detect
1
0
Fork 0
mirror of https://github.com/ut-dacs/ios-ddos-detect.git synced 2025-02-12 10:01:51 +00:00
Code Issues Releases Wiki Activity
ios-ddos-detect/README.md
Daniël van der Steeg d4020fe14f Added first code and documentation
2014-09-12 17:52:00 +02:00

1 KiB
Raw Permalink Blame History

Cisco IOS DDoS Detection

This collection of TCL scripts is a proof of concept DDoS attack detector for Cisco IOS, using flow-based data in IOS. The implementation is based on a Cisco Catalyst 6500 using a Supervisor Engine 720.

Currently there are no actions implemented for when an attack has been detected. The script will only write a message to the syslog to inform the administrator of the attack.

Installation

To install the detection scripts, at least the two main scripts (tm_flow_count.tcl and tm_ddos_detection.tcl) need to be in an EEM directory on the switch.

Then using the usual commands, the EEM scripts can be activated:

switch # configure terminal
switch(config) # event manager policy tm_flow_count.tcl
switch(config) # event manager policy tm_ddos_detection.tcl
switch(config) # end

This starts the 24 hour learning period for the current day type (weekend/weekday). The first time it recognizes a new day type, it again starts a 24 hour learning period for that day type.

License

See LICENSE.txt