Question : Problem: How can you tell if router is being DOS'd?

I have a Cisco 2811 and started seeing some performance problems about a month ago.  I don't see any interface error and traffic is actually light on the interface (as light as 5kbps on FE interface.)  It has NAT and ACLs at present.  I could turn on the ZBFW but have not yet.  So question: How can I determine if I am getting DOS'd?  Thanks.

Answer : Problem: How can you tell if router is being DOS'd?

Typically, a DDoS (bandwidth starvation) attack shows a big jump in traffic.

Other DoS attacks can take different forms, such as trying to crash a specific service.  These are harder to detect, and are different for each vendor/service being attacked.

I would recommend that you enable the IDS/IPS functionality on the router, if this is a concern for you.