Skip to main content
added 71 characters in body
Source Link

I agree with Ricky Beam. You'll have to get a packet capture of the Firewall to see if you are receiving responses for a spoofed broadcast request not made by the SonicWall. Only then would we see if a Smurf / Fraggle attack is happening.

I would check performance statistics and logs on the AP's (wireless) and the SonicWall Firewll. I'd get SNMP setup to look at bandwidth utilization. Start ruling things out.

  1. What does your bandwidth utilization look like on the SonicWall when users report the time they experienced this issue? What's the SonicWall's bandwidth capability? Does the utilization supersede the capability?
  2. If you suspect a Smurf/Fraggle DDoS attack, configure the SonicWall to not respond to ICMP requests or broadcasts. Look in logs and packet captures to find the bogus broadcast replies.
  3. Configure SonicWall to not forward packets directed to a broadcast addresses.
  4. SNMP of SonicWall, look at CPU/RAM utilization. When it is high, is traffic being dropped?
  5. Setup Splunk free version to start capturing logs and have a look at what is happening.

I agree with Ricky Beam. You'll have to get a packet capture of the Firewall to see if you are receiving responses for a spoofed broadcast request not made by the SonicWall. Only then would we see if a Smurf / Fraggle attack is happening.

I would check performance statistics and logs on the AP's (wireless) and the SonicWall Firewll. I'd get SNMP setup to look at bandwidth utilization. Start ruling things out.

  1. What does your bandwidth utilization look like on the SonicWall when users report the time they experienced this issue? What's the SonicWall's bandwidth capability? Does the utilization supersede the capability?
  2. If you suspect a Smurf/Fraggle DDoS attack, configure the SonicWall to not respond to ICMP requests or broadcasts
  3. Configure SonicWall to not forward packets directed to a broadcast addresses.
  4. SNMP of SonicWall, look at CPU/RAM utilization. When it is high, is traffic being dropped?
  5. Setup Splunk free version to start capturing logs and have a look at what is happening.

I agree with Ricky Beam. You'll have to get a packet capture of the Firewall to see if you are receiving responses for a spoofed broadcast request not made by the SonicWall. Only then would we see if a Smurf / Fraggle attack is happening.

I would check performance statistics and logs on the AP's (wireless) and the SonicWall Firewll. I'd get SNMP setup to look at bandwidth utilization. Start ruling things out.

  1. What does your bandwidth utilization look like on the SonicWall when users report the time they experienced this issue? What's the SonicWall's bandwidth capability? Does the utilization supersede the capability?
  2. If you suspect a Smurf/Fraggle DDoS attack, configure the SonicWall to not respond to ICMP requests or broadcasts. Look in logs and packet captures to find the bogus broadcast replies.
  3. Configure SonicWall to not forward packets directed to a broadcast addresses.
  4. SNMP of SonicWall, look at CPU/RAM utilization. When it is high, is traffic being dropped?
  5. Setup Splunk free version to start capturing logs and have a look at what is happening.
Source Link

I agree with Ricky Beam. You'll have to get a packet capture of the Firewall to see if you are receiving responses for a spoofed broadcast request not made by the SonicWall. Only then would we see if a Smurf / Fraggle attack is happening.

I would check performance statistics and logs on the AP's (wireless) and the SonicWall Firewll. I'd get SNMP setup to look at bandwidth utilization. Start ruling things out.

  1. What does your bandwidth utilization look like on the SonicWall when users report the time they experienced this issue? What's the SonicWall's bandwidth capability? Does the utilization supersede the capability?
  2. If you suspect a Smurf/Fraggle DDoS attack, configure the SonicWall to not respond to ICMP requests or broadcasts
  3. Configure SonicWall to not forward packets directed to a broadcast addresses.
  4. SNMP of SonicWall, look at CPU/RAM utilization. When it is high, is traffic being dropped?
  5. Setup Splunk free version to start capturing logs and have a look at what is happening.