On Sun, May 15, 2011 at 10:17 AM, Dobbins, Roland <[email protected]>wrote:
> On May 15, 2011, at 7:49 PM, Joe Freeman wrote: > > > I about to the point where I'm going to create a TCL script and use the > event scheduler just to clear the TIMEWAIT sessions every 12 hours or s > > > It would probably be a good idea to use NetFlow or some other traffic > classification mechanism to get some visibility into the traffic targeting > the box, first. > I would agree with netflow with the addition of an old fashioned packet capture. If you see rst packets for the sessions that are in TIMEWAIT then it could be a bug. If they just are opened but do not close then you could be being DDOS'd. Do you recognize the source IP's of the traffic? I'm not that familiar with webvpn, but is there an idle timer that you could configure? Seems more effective than clearing the sessions periodically. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
