Yes, I'm using NBAR to drop attacks. That traffic is very small compared to overall traffic.
There was another post where it looks like the answer is to upgrade IOS to allow WCCP inspection on the inbound interface instead of outbound. This allows just the WCCP traffic to be process-switched, while everything can stay within the CEF path (if I understand the description properly). On Thu, 31 Oct 2002, Naeem Haq wrote: :>Could be a HTTP attack like Nimda , Code Red etc . :>DO you have the policies defined to drop these !! :> :> :>----- Original Message ----- :>From: "Rick Ernst" <[EMAIL PROTECTED]> :>To: <[EMAIL PROTECTED]> :>Sent: Thursday, October 31, 2002 3:20 AM :>Subject: [isp-caching] High CPU with WCCP :> :> :>> :>> Has anybody seen issues with high CPU utilization on WCCP? <SNIP> ____________ The ISP-CACHING Discussion List ___________ To Join: mailto:join-isp-caching@;isp-caching.com To Remove: mailto:remove-isp-caching@;isp-caching.com Archives: http://isp-lists.isp-planet.com/isp-caching/archives/
