...

I can understand how a virus like Welchia can affect a flow-based architecture like Extremes. I was under the impression that CEF enabled Cisco gear wouldnt have this problem, but Cisco has instructions on their webpage on how deal with it and cites CPU usage as the reason. With CEF I thought the CPU wasn't involved? CEF is perhaps differently implemented on different plattforms?

I think CEF in HW is the key, ASIC based and not Flow based. I'm not all-knowlegable on which platforms do this, but the 7500, 12000, 2948G-L3, 4908 have it.

Yup. We have 6509s with Sup2/MSFC2/PFC2, and have had no problems with ICMP in connection with recent virus/worm attacks. Oh yeah, we also find the 6509s work very well as routers. Full routing tables, etc. YMMV. Steinar Haug, Nethelp consulting, sthaug@nethelp.no