2.44. Threshold; Conn_Threshold_Exceeded (Id: 05300100); Reminder_Conn_Threshold (Id: 05300101); Conn_Threshold_Exceeded (Id: 05300102) - D-Link NetDefend DFL-210 Log Reference Manual

2.44. THRESHOLD

2.44. THRESHOLD
These log messages refer to the THRESHOLD (Threshold rule events) category.

2.44.1. conn_threshold_exceeded (ID: 05300100)

Default Severity
Log Message
Explanation
Gateway Action
Recommended Action
Revision
Parameters
Context Parameters

2.44.2. reminder_conn_threshold (ID: 05300101)

Default Severity
Log Message
Explanation
Gateway Action
Recommended Action
Revision
Parameters
Context Parameters

2.44.3. conn_threshold_exceeded (ID: 05300102)

Default Severity
Log Message
Explanation
Gateway Action
WARNING
Connection threshold <description> exceeded <threshold>. Source IP:
<srcip>. Closing connection
The source ip is opening up new connections too fast.
closing_connection
Investigate worms and DoS attacks.
1
description
threshold
srcip
Rule Name
INFORMATIONAL
Reminder: Connection threshold <description> exceeded <threshold>.
Source IP: <srcip>.
The source ip is still opening up new connections too fast.
None
Look through logs to see if the source ip has misbehaved in the past.
1
description
threshold
srcip
Rule Name
NOTICE
Connection threshold <description> exceeded <threshold>. Source IP:
<srcip>
The source ip is opening up new connections too fast.
None
439
Chapter 2. Log Message Reference