Re: DOS Attack?

[Anthony Boynes <aboynes () cox net>]

Shawn Wall wrote:

> Hi List,
>
> I'm currently experiencing network outages due to what appears to be DOS
> attacks. I'm running a wireless ISP using a Cisco 2611 and CBAC and I have a
> /24 public address range. During the outage I can see traffic from a single
> external host sending thousands of packets to a single internal host. I
> don't have port 80 inbound open in my ACLs so I don't understand how the
> external host is even able to contact the internal host to begin with.
> Secondly, how is it possible for an attack on 1 internal host to cripple the
> rest of my network? Any feedback would be welcome. Thanks.
>
> shawn
>
>
>
>  
How are you viewing this traffic?  Could it be spoofed from the inside?  
Are there any abnormal broadcasts occurring?

Anthony Boynes