ALM-3276800108 User-packets-abnormal alarm

Description

SECE/4/USERABNORMAL: OID [OID] The rate of packets received by a board exceeds the average rate. (board=[OCTET], UserIp=[OCTET], PacketType=[OCTET], NormalRate=[OCTET], ActualRate=[INTEGER]pps)

The rate of packets received by an LPU exceeded the normal rate.

Attribute

Alarm ID	Alarm Severity	Alarm Type
3276800108	Warning	Quality of service alarm

Parameters

Name	Meaning
OID	Indicates the MIB object ID of the alarm.
board	Indicates the LPU slot ID.
user ip	Indicates the IP address of a user.
packet type	Indicates the user packet type.
normal rate	Indicates the normal rate of user packets.
actual rate	Indicates the actual rate of user packets.

Impact on the System

The rate of packets received by an LPU exceeds the normal rate. Excessive packets are dropped. As a result, valid user services are interrupted and device performance degrades.

Possible Causes

The rate of packets received by an LPU exceeded the normal rate.

Procedure

If user services are not affected, the alarm does not need to be handled.
If user services are interrupted, perform the following operations:
1. Run the display anti-attack statistics tcp-syn command to check whether TCP SYN flood attack occurs.
2. Run the display this command in the URL template view of an X series card to check whether other commands, except URL commands, have been executed. If so, delete these commands.
3. Check whether wireless-to-wired (wireless users access the AC, and are authenticated by the switch) is configured on a card except the X series card. If so, replace the card with an X series card. If not, no action is required.
4. If this alarm is repeatedly reported and the alarms contain the same user IP address, check whether this user can go online. If the user can go online, no action is required. If the user fails to go online, check whether this user is authorized.
5. If the alarm persists, collect alarm, log, and configuration information of the device, and contact technical support personnel.