IT Employment

Ask something
Discussion Locked

Stopping worms in their tracks...

0 helpful
1 reply

by itblackbelt

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I was flipping through the Cisco Online IOS Documentation the other day and was suprised to learn that the effects of worms such as Code Red can be defeated at the router level by adding a simple filter (script). This has the effect of stopping such agents from chewing up bandwidth. If this can be done, why are we not hearing about it from the "Experts"? Is there a downside to this that makes it an undesirable option? It seems to me that the router would be an ideal point of engagement against net-bourne worms and trojans since everything must pass through a router to get anywhere. What do you think?

1 reply

by jon pratt

The obvious drawback that I see is that routers would base their blocking on anomalies not signatures. It is certainly an anomaly, in most environments, for an individual machine to make a lot of simultaneous connections to several hosts on commonly open ports such as ICMP(ping floods). A router could easily identify this anomaly and block the machine under the assumption that it's attempting a DDOS attack. If the routers had adjustable thresholds and allowed for certain IPs to be exempt(access/filter lists) from the blocking then I think router level safeguards may work. I guess it would be more of an audtiting type defense than a virus quarentine. Of course I should qualify everything that I've just said with the fact that I've readnothing about this until this post so I could be way off base on how they're considering implementing routers in the war against DDOS worms. Nevertheless it's an issue that's only going to get worse before it gets better especially with the ever increasing prevalence of hiCAP lines in residences....

This discussion is closed to new replies.