fraggle attack mitigation.

[Jose_Estrada]

How to prevent an attack fraggle in my switchin with Enterasys infrastructure? and above all, how to detect the source of these attacks?

[Mike_Thomas]

Jose, from the data that you have provided I can state the following. The router output you attached tells us that we are dropping the data that appears to be be suspect and are not forwarding it any further. There is lots of room for false positive with some applications that are used that use some form of virtual addressing (typically servers), but the issue should be investigated further of course to ensure that your network is in healthy condition. Please engage the GTAC via Brian and we can assist you in further understanding and remediating the issue. If we have any further informative results from the investigation, we will post them to the community hub.

[Brian_Townsend]

Jose, Good day, I hope you are well. The GTAC would like to open a case with you on this. Please send me your contact information so we can open a case. Once the GTAC case has concluded we will post the appropriate conclusion in theHUB for all to see. I can be contacted at btownsen@enterasys.com Thank you Brian Townsend

[Tamera_Rousseau]

Jose, this really is something we need to open a trouble ticket for. Can you please email me your company/contact information? troussea@enterasys.com.

[Jose_Estrada]

Support-> show hostdos stats HostDos is globally Enabled --------------------------------------------------------------------- Threat Ena Violation Last Occurrence ble Log Count Port VLAN Date and Time --------------------------------------------------------------------- arpNd Y Y 0 N/A N/A N/A badSIP Y Y 0 N/A N/A N/A fraggle Y Y 4336 ge.2.20 13 2013-10-14 20:15:42 icmpFlood Y Y 0 N/A N/A N/A icmpFrag Y Y 0 N/A N/A N/A icmpSize N Y 0 N/A N/A N/A lanD Y Y 0 N/A N/A N/A portScan N Y 0 N/A N/A N/A smurf Y Y 0 N/A N/A N/A spoof Y Y 0 N/A N/A N/A synFlood Y Y 0 N/A N/A N/A xmasTree Y Y 0 N/A N/A N/A