Cisco Systems 2.5 View Top Attacks

42-33
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Chapter42 Viewing Router Information
Logging
%SEC-6-IPACCESSLOGDP: list 100 denied icmp 171.71.225.148->10.77.158.140 (0/0), 3 packets
Update Button
Polls the router and updates the information shown on the screen with current
information.
Search Button
Opens a search window. Choose a search type from the Search menu and enter
the appropriate text in the Search field, then click the Find button to display
matching log entries.
The search types are:
•Source IP Address—The IP address of the origin of the attack.
A partial IP address can be entered.
•Destination IP Address—The IP address of the target of the attack.
A partial IP address can be entered.
•Protocol—The network protocol used in the attack.
•Text—Any text found in the log entry.
Searches are not case sensitive.
View Top Attacks
From the View drop-down menu, choose one of the following ways to display
information on top attacks:
•Top Attack Ports—Top attacks by target port.
•Top Attackers—by attacker IP address.
The top-attacks table below the View drop-down menu displays the top attack
entries. If you choose Top Attack Ports from the View drop-down menu, the
top-attacks table displays entries with the following columns:
•Port Number—The target port.
•Number of attacks—The number of attacks against the target port.
•Number of packets denied—The number of packets denied access to the
target port.