
© 2013 Cisco and/or its affiliates. All rights reserved.
BRKCRS-3090
Cisco Public
EEM with Flexible NetFlow
81
Problem: CPU processing required to
respond to packets with TTL values of
one or less.
•(using TTL-exceeded packets)
Cannot forward a packet with a TTL
value Less than one.
Results in a Denial of Service attack
NetFlow Counters available for EEM
E.g. look for packets with Time To Live
(TTL) less than or equal to 1.
EEM can also be
configured to start
a wireshark capture
flow record ttl
match ipv4 ttl
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
flow monitor ttl
record ttl
cache timeout inactive 20
cache timeout active 30
interface GigabitEthernet8/47
switchport access vlan 50
switchport mode access
ip flow monitor ttl input
event manager applet ttl
event nf monitor-name "ttl" event-type create event1 entry-value "2" field ipv4 ttl entry-op lt
action 1.0 syslog msg "TTL=1 frames from $_nf_source_address to $_nf_dest_address detected.“
action 2.6 cli command "conf t"
action 2.7 cli command "int gi 2/2"
action 2.8 cli command "shut"
Flexible NetFlow
Configuration
EEM Configuration
Packet TTL=1
REFERENCE
Kommentare zu diesen Handbüchern