Table of Contents
Advertisement
Appendix B
Proprietary MIB Reference
linkModeForwardingTrap (1.3.6.1.4.1.5655.4.0.21)
The link mode has changed to forwarding.
linkModeCutoffTrap (1.3.6.1.4.1.5655.4.0.22)
The link mode has changed to cutoff.
moduleAttackFilterActivatedTrap (1.3.6.1.4.1.5655.4.0.25)
The attack filter module has detected an attack and activated a filter. The type of attack-filter that was
activated is returned in pcubeSeEventGenericString1.
Following are several examples of pcubeSeEventGenericString1 for various scenarios:
•
•
OL-7827-12
Attack detected automatically (the number of open flows or ddos-suspected flows has exceeded
the maximum configured for the attack detector):
Source of the attack is detected (at the subscriber side, IP address = 10.1.4.134, attacking the
–
network side using UDP., number of open flows = 10000, configured action is 'report'):
Attack detected: Attack from IP address 10.1.4.134, from subscriber side, protocol
UDP. 10000 concurrent open flows detected, 57 concurrent Ddos-suspected flows
detected. Action is: Report.
Target of the attack is detected (at the network side, IP address = 10.1.4.135, being attacked
–
from the subscriber side using ICMP, number of ddos-suspected flows = 500, configured action
is 'block'):
Attack detected: Attack on IP address 10.1.4.135, from subscriber side, protocol ICMP.
745 concurrent open flows detected, 500 concurrent Ddos-suspected flows detected.
Action is: Block.
Forced filtering using the 'force-filter' command:
Action is 'block', attack-direction is attack-source, side is subscriber, IP address = 10.1.1.1, and
–
protocol is TCP:
Attack filter: Forced block of flows from IP address 10.1.1.1, from subscriber side,
protocol TCP. Attack forced using a force-filter command.
When the action is 'report', attack-direction is attack-destination, side is subscriber, IP address
–
= 10.1.1.1, and protocol is Other:
Attack filter: Forced report to IP address 10.1.1.1, from network side, protocol
Other. Attack forced using a force-filter command.
Cisco SCE 2000 and SCE 1000 Software Configuration Guide
pcubeWorkgroup (1.3.6.1.4.1.5655.4)
B-21
Advertisement
Table of Contents
