Connection-Rate Log And Trap Messages - HP ProCurve 6200yl Series Access Security Manual

Message
Address not found in list of blocked
hosts.
mm/dd/yy hh:mm:ss
W <
< xxx.xxx.xxx.xxx >
address
virus-like behavior
mm/dd/yy hh:mm:ss
W <
< xxx.xxx.xxx.xxx >
address
mm/dd/yy hh:mm:ss
W <
< xxx.xxx.xxx.xxx >
blocked
Monitoring Shared Resources: Active instances of throttling or
■
blocking a client that is generating a high rate of connection requests
uses internal routing switch resources that are shared with several
other features. The routing switch provides ample resources for all
features. However, if the internal resources become fully subscribed,
new instances of throttling or blocking cannot be initiated until the
necessary resources are released from other uses. (Event Log
messages and SNMP traps are not affected.) For information on
determining current resource availability and usage, refer to the
appendix titled "Monitoring Resources" in the Management and
Configuration Guide for your switch.

Connection-Rate Log and Trap Messages

These messages appear in the switch's Event Log. If SNMP trap receivers are
configured on the switch, it also sends the messages to the designated
receiver(s).
> virusfilt: Source IP
is exhibiting
> virusfilt: Source IP
has been throttled port configured for throttle detects a relatively high
> virusfilt: Src IP
Connection-Rate Log and Trap Messages
Meaning
Appears in the CLI when the
rate-filter unblock
command has been executed to
unblock hosts that are not currently blocked.
A warning that results when a port configured for notify-
only detects a relatively high number of connection-rate
attempts from a host.
A warning and indication of the switch's response when a
number of connection-rate attempts from a host.
A warning and indication of the switch's response when a
port configured for block detects a relatively high number
of connection-rate attempts from a host.
Virus Throttling
vlan < vid > connection-
3-31