HP 9304m Installation And Getting Started Manual page 325

Installation and Getting Started Guide
Message Level Message
Notification Local ICMP exceeds <burst-max> burst
packets, stopping for <lockup> seconds!!
Notification Local TCP exceeds <burst-max> burst
packets, stopping for <lockup> seconds!!
Notification Transit ICMP in interface <portnum>
exceeds <num> burst packets, stopping for
<num> seconds!!
Notification Local TCP exceeds <num> burst packets,
stopping for <num> seconds!!
A - 28
Table A.2: HP Syslog Messages (Continued)
Explanation
The number of ICMP packets exceeds the
<burst-max> threshold set by the ip icmp
burst command. The HP device may be the
victim of a Denial of Service (DoS) attack.
All ICMP packets will be dropped for the
number of seconds specified by the
<lockup> value. When the lockup period
expires, the packet counter is reset and
measurement is restarted.
The number of TCP SYN packets exceeds
the <burst-max> threshold set by the ip tcp
burst command. The HP device may be the
victim of a TCP SYN DoS attack.
All TCP SYN packets will be dropped for the
number of seconds specified by the
<lockup> value. When the lockup period
expires, the packet counter is reset and
measurement is restarted.
Threshold parameters for ICMP transit
(through) traffic have been configured on an
interface, and the maximum burst size for
ICMP packets on the interface has been
exceeded.
The <portnum> is the port number.
The first <num> is the maximum burst size
(maximum number of packets allowed).
The second <num> is the number of
seconds during which additional ICMP
packets will be blocked on the interface.
Note: This message can occur in response
to an attempted Smurf attack.
Threshold parameters for local TCP traffic on
the device have been configured, and the
maximum burst size for TCP packets has
been exceeded.
The first <num> is the maximum burst size
(maximum number of packets allowed).
The second <num> is the number of
seconds during which additional TCP
packets will be blocked on the device.
Note: This message can occur in response
to an attempted TCP SYN attack.