Cisco ASA 5505 Configuration Manual page 1097

Chapter 51 Configuring Threat Detection
Types of Traffic Monitored
Only through-the-box traffic is monitored; to-the-box traffic is not included in threat detection.
Default Settings
Basic threat detection statistics are enabled by default.
Table 51-1
running-config all threat-detection command in Tools > Command Line Interface.
Table 51-1
Packet Drop Reason
•
•
•
•
Scanning attack detected
Incomplete session detected such as
TCP SYN attack detected or no data
UDP session attack detected
(combined)
Denial by access lists
•
•
Interface overload
OL-20339-01
lists the default settings. You can view all these default settings using the show
Basic Threat Detection Default Settings
DoS attack detected
Bad packet format
Connection limits exceeded
Suspicious ICMP packets
detected
Basic firewall checks failed
Packets failed application
inspection
Configuring Basic Threat Detection Statistics
Trigger Settings
Average Rate
100 drops/sec over the last 600
seconds.
80 drops/sec over the last 3600
seconds.
5 drops/sec over the last 600
seconds.
4 drops/sec over the last 3600
seconds.
100 drops/sec over the last 600
seconds.
80 drops/sec over the last 3600
seconds.
400 drops/sec over the last 600
seconds.
320 drops/sec over the last
3600 seconds.
400 drops/sec over the last 600
seconds.
320 drops/sec over the last
3600 seconds.
2000 drops/sec over the last
600 seconds.
1600 drops/sec over the last
3600 seconds.
Cisco ASA 5500 Series Configuration Guide using ASDM
Burst Rate
400 drops/sec over the last 10
second period.
320 drops/sec over the last 60
second period.
10 drops/sec over the last 10
second period.
8 drops/sec over the last 60
second period.
200 drops/sec over the last 10
second period.
160 drops/sec over the last 60
second period.
800 drops/sec over the last 10
second period.
640 drops/sec over the last 60
second period.
1600 drops/sec over the last 10
second period.
1280 drops/sec over the last 60
second period.
8000 drops/sec over the last 10
second period.
6400 drops/sec over the last 60
second period.
51-3