Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to monitor DoS attacks with SNMP or any other software which based on Linux and could monitor router / switches and alert when a DoS attack is observed?

share|improve this question

closed as not a real question by pauska, Scott Pack, EEAA, HopelessN00b, Ladadadada Aug 27 '12 at 13:21

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

There most certainly is, though it depends on the nature of the DoS and the instrumentation exposed by SNMP.

  • Packets-per-second is a good metric to grab if the device supports it, since many DoS attacks show up as lots of packets attempting to saturate the links ability to track that many items.
  • Interface throughput likewise, since another way to DoS is to throw more traffic than the link can handle.
  • CPU is another great one, since device-specific DoS attacks can manifest as the router/firewall/switch CPU running out and causing bad things to happen.

Be sure to set above-normal alert threshold in your monitoring package, and you should catch those.

share|improve this answer

SNMP is only a tool to retrieve informations, counters, from a device.

Using only snmp, you'll only be able to get traffic flowing through the interfaces, and basic informations such as CPU and RAM usage.

Netflow, on the other hand, is a protocol designed to report flow pattern, and is very useful to detect DoS attacks.

You can combine the two and use a Netflow MIB that will report the top-talkers, and allow you to monitor the ongoing DoS.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.