3

Today i have detected Cisco ASA 5505 CPU usage went to 100% and LAN was flood with broadcast (ff:ff:ff:ff:ff) going to 10.0.12.255 address, i have noticed all these activity in wireshark that some strange stuff going on.

I jump on firewall (Cisco ASA) and did show conn where i found following

ASA(config)# show conn
1946 in use, 50002 most used


UDP eng  10.0.12.255:44678 inside  10.0.10.92:59654, idle 0:00:00, bytes 21657163800, flags -
ICMP eng 10.0.12.255:0 inside  10.0.10.92:61597, idle 0:00:00, bytes 8142154200, flags
UDP eng  10.0.12.255:31796 inside  10.0.10.92:59654, idle 0:00:00, bytes 18100194900, flags -
ICMP eng 10.0.12.255:0 inside  10.0.10.92:8018, idle 0:00:00, bytes 5909738400, flags
ICMP eng 10.0.12.255:0 inside  10.0.10.92:44296, idle 0:00:00, bytes 0, flags
ICMP eng 10.0.12.255:0 inside  10.0.10.92:19044, idle 0:00:00, bytes 0, flags
UDP eng  10.0.12.0:40776 inside  10.0.10.92:59705, idle 0:00:00, bytes 18865919700, flags -
UDP eng  10.0.12.0:34428 inside  10.0.10.92:59705, idle 0:00:00, bytes 24248390700, flags -
ICMP eng 10.0.12.0:0 inside  10.0.10.92:56833, idle 0:00:00, bytes 7659338550, flags
ICMP eng 10.0.12.0:0 inside  10.0.10.92:3821, idle 0:00:00, bytes 0, flags
ICMP eng 10.0.12.0:0 inside  10.0.10.92:27263, idle 0:00:00, bytes 0, flags
ICMP eng 10.0.12.0:0 inside  10.0.10.92:30586, idle 0:00:00, bytes 0, flags

It was clean 10.0.10.92 doing something bad so we have find source and shutdown that PC (windows desktop) but interesting enough broadcast didn't stop it was still going on.

Finally after 30 minute of dancing i decided to clear conn table and as soon as i did following everything started looking good. 

ASA(config)# clear conn address 10.0.10.92
28 connection(s) deleted.

can someone explain me what was going on here?

Improve this question
7
  • It sounds like you have a broadcast storm where you have a loop caused by an STP failure. Basically, you need to break the loop. That usually involves shutting down switches until the problem is fixed, but then you need to find where you have a misconfiguration for STP.
    – Ron Maupin ♦
    Commented May 29, 2019 at 17:44
  • This is office LAN ( Not datacenter ) In office i have Cisco ASA5505 and one cisco 2960 switch ( very simple office network ) nothing fancy here, Cisco ASA is just gateway for everyone in office ( NATing), Even no STP in office
    – Satish
    Commented May 29, 2019 at 17:53
  • Is there any device with two connections? I have even seen Windows PC with bridging enabled cause STP loops.
    – Ron Maupin ♦
    Commented May 29, 2019 at 17:56
  • We have shutdown PC but still problem was there but when i clear conn it got resolved. trying to understand why firewall keeping them alive.. may be its in loop and firewall can't kill connection because repeating over and over
    – Satish
    Commented May 29, 2019 at 17:59
  • 3
    That PC is only the source of the broadcast. The loop is somewhere else, and the loop keeps the broadcast alive, even when the source is shut down. If there is only one switch, you need to shut it down and restart. If the problem recurs, then you need to find the loop.
    – Ron Maupin ♦
    Commented May 29, 2019 at 18:01

1 Answer 1

Reset to default
0

Step 1: Analyze the network traffic Use Wireshark or a similar packet capture tool to analyze the broadcast traffic and identify the source and destination of the excessive broadcasts.

Step 2: Identify the cause of the broadcast flooding Investigate the processes or applications running on the devices involved to identify the cause of the broadcast flooding. Look for misconfigured applications, malware infections, or other issues that could be generating excessive broadcast traffic.

Step 3: Take appropriate actions on the source device If you identify a specific device causing the broadcast flooding, take the necessary steps to address the issue on that device. This may involve scanning the device for malware, updating software, or reconfiguring network settings.

Step 4: Implement network-level controls To mitigate the impact of broadcast flooding, implement network-level controls on your Cisco ASA firewall. Consider the following commands:

asa(config)# access-list broadcast-control extended deny ip any any log
asa(config)# access-group broadcast-control in interface inside
asa(config)# access-list rate-limit extended permit ip any any
asa(config)# class-map rate-limit
asa(config-cmap)# match access-list rate-limit
asa(config-cmap)# exit
asa(config)# policy-map rate-limit-policy
asa(config-pmap)# class rate-limit
asa(config-pmap-c)# police input 1000000 8000
asa(config-pmap-c)# police output 1000000 8000
asa(config-pmap-c)# exit
asa(config-pmap)# exit
asa(config)# service-policy rate-limit-policy interface inside
The above commands implement an access control list (ACL) to deny IP traffic and log it, as well as rate-limiting controls to limit the rate of incoming and outgoing traffic on the inside interface of the Cisco ASA firewall.

Step 5: Apply security patches and updates Ensure that both the Cisco ASA firewall and the Windows desktop have the latest security patches and updates installed. This helps address any known vulnerabilities that could be exploited to cause broadcast flooding or other malicious activities.

Step 6: Monitor network traffic continuously Enable logging on the Cisco ASA firewall to monitor network traffic continuously. Review the logs and alerts regularly to detect any abnormal or suspicious traffic patterns and take appropriate actions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.