Is there any way to monitor DoS attacks with SNMP or any other software which based on Linux and could monitor router / switches and alert when a DoS attack is observed?
closed as not a real question by pauska, Scott Pack, EEAA, HopelessN00b, Ladadadada Aug 27 '12 at 13:21
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.
There most certainly is, though it depends on the nature of the DoS and the instrumentation exposed by SNMP.
Be sure to set above-normal alert threshold in your monitoring package, and you should catch those.
SNMP is only a tool to retrieve informations, counters, from a device.
Using only snmp, you'll only be able to get traffic flowing through the interfaces, and basic informations such as CPU and RAM usage.
Netflow, on the other hand, is a protocol designed to report flow pattern, and is very useful to detect DoS attacks.
You can combine the two and use a Netflow MIB that will report the top-talkers, and allow you to monitor the ongoing DoS.