Identify the source of a (D)DOS attack

Packet capture

This must be done from the edge device that is under attack. If the edge device lacks capture abilities (tshark, Wireshark, etc.) that can be done remotely, you're going to need physical access to the device.

Tshark (*nix)

1. Run the following command from cli: <code>tshark -ni <inbound interface> -w /tmp/<filename>.cap</code> File name can be anything, but preferably date and instance number of the capture.
2. After 500-1000 packets are captured, close the tshark session with Ctrl-C
3. Copy file off of edge device to a computer that can run Wireshark.

Wireshark

1. Open Wireshark and start a new session after selecting the appropriate inbound interface.
2. After 500-100 packets are captured, stop the capture and save the session. As stated above, the file name can be anything, but preferably date and instance number of the capture.

Adtran AOS

• NOTE: The ability to do a packet capture on an Adtran is dependent on the model compatability and requires firmware release R10.1.0 or later.
• See Adtran's Configuring Packet Capture in AOS document for in-depth instructions.

Other options if local/physical access is available

• Hardware based capture device
• ARP poisoning (May or may not be an option based on legality & hardware compatability)

Monitor web traffic

Using monitoring programs such as rflow, NTop, etc.