CSS DoS illegal Src Attack

Question

Hi,
On my CSS 11506, logs are full of these kind of error messages:
"NETMAN-5: Enterprise:DOS Attack:Illegal Src -> 5 times". It also generates a trap every seconds, flooding our syslogd and trapd server.
The first information one would obviously require is which IP address, and on which interface, is causing this error message.
I had a look at the "sh dos" command and I can see the counter for "Illegal Src Attacks" increasing (quite logical), BUT then in the detailed events, I can't see any of these events, I only see few SYN Attacks detailed events.
So does anyone know where I can get the details for these "Illegal Src Attacks" events ?
Many Thanks for any help,
Regards,
Arno

Answer 1

Hi to all,
i desperate need your help.
I got a very similar problem with CSS.
Same DoS attack. (many Syn Attack visible in the "show dos" detailed command and many Src Attack but only in the counters)
The strange thing is that the ip address involved are unicast ip (not multicast).
I've not understand many things.
The first is , what's the reason why CSS see that 10.6.27.133 is an Illegal Src??? (It's in this case the .133 is the ip address of interface 6/9 of CSS)
OS Attack Event  1:
First Attack: 31/08/2010 22:52:24
Last Attack:  31/08/2010 22:52:34
Source Address:             10.6.27.133 Destination Address:         10.6.84.69
Event Type:                 Illegal Src Total Attacks:                        3
Someone can help me to understand?
Below is the "show dos" with one event as an example
Total Attacks: 33170637
SYN Attacks:                 14,843,912 Maximum per second:                 284
LAND Attacks:                         0 Maximum per second:                   0
Zero Port Attacks:                    0 Maximum per second:                   0
Illegal Src Attacks:         18,325,982 Maximum per second:                 224
Illegal Dst Attacks:                743 Maximum per second:                   4
Smurf Attacks:                        0 Maximum per second:                   0
DOS Attack Event 12:
First Attack: 31/08/2010 22:18:34
Last Attack:  31/08/2010 22:31:26
Source Address:             10.6.67.167 Destination Address:     113.213.43.145
Where do you suggest to investigate??
Many thanks,
M.G.