One of my clients has been told by their ISP that a DoS attack has happened and they have provided the logs of Juniper router. What is the criteria in routers on which we can confirm DoS attack is happening/occurred?

Any article or data to show some light on finding attacks through routers? Log basically says:

Nov 5 12:24:42 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed unset:>xx.xx.xx.xx/50544 None>xx.xx.xx.xx/50544 None None 17 1000 Trust Trust 336106 0(0) 0(0) 1 UNKNOWN UNKNOWN N/A(N/A) ge-2/0/21.0

  • The rules that each router uses is going to be up to the router operating system. What you need to do is to look up Juniper's manuals on line to see how they determine DoS in the traffic flow.
    – schroeder
    Dec 7, 2015 at 21:49

1 Answer 1


You probably mean to include DDoS attacks (Distributed Denial of Service) rather than DoS attacks which could technically be a single packet (think Ping of Death).

None the less the criteria you are asking about is slightly different from provider to provider but a few things which are easily tracked by these devices are the following:

1.) Seeing systems suddenly generate large bursts of traffic, above 10,000 packet per second is a good rule of thumb.

2.) Seeing large numbers of packets leaving a customers network with falsified source IP addresses. In theory this would be blocked by egress rules but it does happen.

3.) Large amounts of intentionally malicious traffic. SYN Flood attacks, UDP Flood attacks, DNS Amplification attacks, Bulk SNMP requests sent from a "target" host.

4.) Large amounts of intentionally fragmented packets.

Cisco, a large commercial routing manufacturer, has a document which may also give you more insight into what can be detected.


Wikipedia has a really useful entry on Denial of Service Attacks that also mentions a lot of the network traffic you will want to look for.


Finally the following paper may also be useful


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .