ALM-3276800101 IPSG drop

Description

SECE/4/IPSG_DROP_ALARM: OID [OID] The packet number dropped by IPSG reaches [INTEGER1], exceed the alarm threshold [INTEGER2], interface [OCTET].

The number of packets discarded by IPSG exceeded the alarm threshold.

Attribute

Alarm ID	Alarm Severity	Alarm Type
3276800101	Warning	Equipment alarm

Parameters

Name	Meaning
OID	Indicates the MIB object ID of the alarm.
INTEGER1	Indicates the number of discarded packets.
INTEGER2	Indicates the alarm threshold.
OCTET	Indicates the source interface, VLAN, source MAC address, and source IP address of packets.

Impact on the System

If this alarm is generated, the device may be attacked. If the attack traffic volume is heavy, the device is busy processing attack packets. As a result, services of authorized users are interrupted.

Possible Causes

The number of packets discarded by IPSG exceeded the alarm threshold. This threshold can be configured using the ip source check user-bind alarm threshold command. The default alarm threshold is 100.

Procedure

Find the interface where attacks occur according to Interface in the alarm message.
Check whether users who are not in the DHCP snooping binding table range are connected.
If new users are connected, run related DHCP snooping commands to generate the DHCP snooping binding table.