networking - ESXi server under DoS attack, can I use SSH to determine where from?

My VMWare ESXi 4 server appears to be under a Denial of Service
attack. I am getting massive packet loss to the server (60+%) and am barely able to load
any services on the VMs running on the host.

I
have Cacti installed but cannot load it due to the attack. I can SSH in to the VMware
host. Are there any commends I can run to either determine where the attack is coming
from, or block all IP addresses except mine so that I can load Cacti again to
troubleshoot?

I tried
esxcli network firewall get but received: Unknown
Object firewall in namespace
network

All the VMs with network
access are directly connected to the internet, that is, there is a virtual switch
between the internet-facing VMs and the
router.

EDIT: href="http://chat.stackexchange.com/transcript/message/5540722#5540722">MDMarra had a
great idea: disable the vswitch that the VMs are on. But I can't get the
vSphere console to respond long enough to do this. Can this be done through
SSH?

Answer

The ISP was unable to determine the cause of
the traffic, but what they were able to do was null-route all the IP addresses assigned
to this server at the network switch. Then, one-by-one we removed the null routes, until
we determined which IP addresses were being attacked. Once the target IPs were
null-routed, the problem went away and I am able to access the server
again.

I am now going to console in to the
affected VMs and start tcpdump, and then remove the null-routes
to those VMs. This will allow me to find the source IPs of the attack, which can be
blocked by my ISP before traffic from them enters the core
network.