Monitoring Syn Attacks In Contexts - Cisco PIX 500 Series Configuration Manual

Managing Security Contexts
The following is sample output from the show resource usage context command, which shows the
resource usage for the admin context:
hostname# show resource usage context admin
Resource
Telnet
Conns
Hosts
The following is sample output from the show resource usage summary command, which shows the
resource usage for all contexts and all resources. This sample shows the limits for 6 contexts.
hostname# show resource usage summary
Resource
Syslogs [rate]
Conns
Xlates
Hosts
Conns [rate]
Inspects [rate]
S = System: Combined context limits exceed the system limit; the system limit is shown.
The following is sample output from the show resource usage summary command, which shows the
limits for 25 contexts. Because the context limit for Telnet and SSH connections is 5 per context, then
the combined limit is 125. The system limit is only 100, so the system limit is shown.
hostname# show resource usage summary
Resource
Telnet
SSH
Conns
Hosts
S = System: Combined context limits exceed the system limit; the system limit is shown.
The following is sample output from the show resource usage system command, which shows the
resource usage for all contexts, but it shows the system limit instead of the combined context limits. The
counter all 0 option is used to show resources that are not currently in use. The Denied statistics indicate
how many times the resource was denied due to the system limit, if available.
hostname# show resource usage system counter all 0
Resource
Telnet
SSH
ASDM
Syslogs [rate]
Conns
Xlates
Hosts
Conns [rate]
Inspects [rate]

Monitoring SYN Attacks in Contexts

The security appliance prevents SYN attacks using TCP Intercept. TCP Intercept uses the SYN cookies
algorithm to prevent TCP SYN-flooding attacks. A SYN-flooding attack consists of a series of SYN
packets usually originating from spoofed IP addresses. The constant flood of SYN packets keeps the
Cisco Security Appliance Command Line Configuration Guide
6-20
Current Peak
1 1
44 55
45 56
Current Peak
1743 2132
584 763
8526 8966
254 254
270 535
270 535
Current Peak
1 1
2 2
56 90
89 102
Current Peak
0 0
0 0
0 0
1 18
0 1
0 0
0 2
1 1
0 0
Chapter 6 Adding and Managing Security Contexts
Limit Denied Context
5 0 admin
N/A 0 admin
N/A 0 admin
Limit Denied Context
N/A 0 Summary
280000(S) 0 Summary
N/A 0 Summary
N/A 0 Summary
N/A 1704 Summary
N/A 0 Summary
Limit Denied Context
100[S] 0 Summary
100[S] 0 Summary
N/A 0 Summary
N/A 0 Summary
Limit Denied
100 0
100 0
32 0
N/A 0
280000 0
N/A 0
N/A 0
N/A 0
N/A 0
Context
System
System
System
System
System
System
System
System
System
OL-12172-03