Release M.10.04 Enhancements; Instrumentation Monitor - HP ProCurve Series 3400cl Release Notes

Enhancements

Release M.10.04 Enhancements

ProCurve# show sflow sampling-polling 1-5
sflow destination Enabled
Port | Sampling
Enabled
----- + -------
1 | Yes
2 | No
3 | Yes
4 | Yes
5 | Yes
Figure 15. Example of Viewing sFlow Sampling and Polling Information
The show sflow all command combines the outputs of the preceding three show commands including
sFlow status information for all the ports on the switch.
Release M.10.04 Enhancements
Release M.10.04 includes the following enhancements:
■ Enhancement (PR_1000330743) - Instrumentation Monitor, which includes Denial of Service
(DoS) logging enhancement.
■ Enhancement (PR_1000331027) - TCP/UDP port closure enhancement.
Enhancement (PR_1000330532) - Improved the "show" command display of STP port detail
■
information to assist in monitoring and troubleshooting of the spanning tree protocol.

Instrumentation Monitor

The 3400cl switches have instrumentation to monitor many operating parameters at pre-determined
intervals. Beginning with software release M.10.04, this capability can be used to detect anomalies
caused by security attacks or other irregular operations on the switch. The following table shows the
parameters that can be monitored, and the possible security attacks that may trigger an alert:
Parameter Name
pkts-to-closed-ports
arp-requests
70
Rate Header Samples
-------- ------ ---------- + ------- --------
6500000 128
50 128
2000 100
200 100
20000 128
Description
The count of packets per minute sent to closed TCP/UDP ports. An excessive amount
of packets could indicate a port scan, in which an attacker is attempting to expose a
vulnerability in the switch.
The count of ARP requests processed per minute. A large amount of ARP request
packets could indicate an host infected with a virus that is trying to spead itself.
Dropped | Polling
| Enabled
5671234 Yes
0 Yes
24978 No
4294967200 Yes
34 Yes
Interval
60
300
30
40
500