ALM-303046937 Attack occurred

SECE/4/STRACKPORT: OID=[OID] Attack occurred.(Interface=[STRING], CVLAN=[ULONG], PVLAN=[ULONG], EndTime=[STRING], TotalPackets=[ULONG])

The system detects an attack on an interface.

Alarm ID	Alarm Severity	Alarm Type
303046937	Warning	securityServiceOrMechanismViolation

Name	Meaning
OID	Indicates the MIB object ID of the alarm.
Interface	Indicates the access interface of the attacker.
CVLAN	Indicates the outer VLAN ID of the attacker.
PVLAN	Indicates the inner VLAN ID of packets sent from the attacker.
EndTime	Indicates the end time of the attack.
TotalPackets	Indicates the number of packets received from the attacker.

The CPU is busy processing attack packets. As a result, normal service packets cannot be processed in time or even discarded.

The number of packets with the specified interface and VLAN ID sent to the CPU exceeds the alarm threshold.

If an attack is initiated by a user and the user is the only one connected to the interface, you can shut down the interface and check whether the interface is normal.
If the interface is connected to multiple users and some users initiate attacks, you can set the action taken on attack packets to deny, or configure a traffic policy to discard attack packets.
If only entries exist on the interface or entries cannot be determined, collect device configurations, alarms, and logs, and then contact technical support personnel.
End.