ALM-3276800104 The System Detected an Attack Source and Dropped Packets Sent from the Attack Source

Description

SECE/4/STRACK_DENY: OID [OID] Some packets are dropped because an attack is detected. (Interface=[OCTET], SourceMAC=[OCTET], SourceIP=[OCTET], InnerVlan=[INTEGER], OuterVlan=[INTEGER])

The system detected an attack source and dropped packets sent from the attack source.

Attribute

Alarm ID	Alarm Severity	Alarm Type
3276800104	Warning	securityServiceOrMechanismViolation(10)

Parameters

Name	Meaning
OID	Indicates the MIB object ID of the alarm.
Interface	Indicates the access interface of the attacker.
SourceMAC	Indicates the Source MAC address of packets sent from the attacker.
SourceIP	Indicates the Source IP address of packets sent from the attacker.
InnerVlan	Indicates the inner VLAN ID of packets sent from the attacker.
OuterVlan	Indicates the outer VLAN ID of packets sent from the attacker.

Impact on the System

The device detected an attack to the CPU and dropped packets sent from the attack source to the CPU.

Possible Causes

A user sent a large number of packets to the user, and the number of packets exceeded the threshold for identifying an attack.

Procedure

Run the display auto-defend attack-source detail command to check the detected attack source and check whether it is an authorized user.
If the detected attack source is an unauthorized user, you do not need to take any actions because the attack packets have been dropped by the device. Go to Step 6.
If the detected attack source is an authorized user, add the user to the whitelist to exclude the user from attack source tracing.
If multiple attack sources are detected and all of them are authorized users, the attack source tracing threshold is too low. (The default value is 128 pps). Run the auto-defend threshold threshold command to increase the threshold. Go to Step 6.
If the alarm persists, collect the configuration, alarms, and logs of the device and contact technical support personnel.
End.