ALM-3276800098 Dai drop alarm
Description
SECE/4/DAI_DROP_ALARM: OID [oid] The packet number dropped by DAI reaches [INTEGER], exceed the alarm threshold [INTEGER], Interface [OCTET].
The number of packets discarded by Dynamic ARP Inspection (DAI) on an interface exceeds the alarm threshold.
Attribute
Alarm ID |
Alarm Severity |
Alarm Type |
---|---|---|
3276800098 |
Warning |
Equipment alarm |
Parameters
Name |
Meaning |
---|---|
OID |
Indicates the MIB object ID of the alarm. |
INTEGER1 |
Indicates the number of discarded packets. |
INTEGER2 |
Indicates the alarm threshold. |
Interface |
Indicates the VLAN, source MAC address, and source IP address of packets |
Impact on the System
If this alarm is generated, the device may be attacked. If the attack traffic volume is heavy, the device is busy processing attack packets. As a result, services of authorized users are interrupted.
Possible Causes
The number of packets discarded by DAI exceeds the alarm threshold. By default, the alarm threshold for ARP packets discarded by DAI is 100 packets.
Procedure
- If user services are not affected, the alarm does not need to be handled.
- If user services are interrupted, perform the following operations:
- Run the display dhcp static user-bind { { interface interface-type interface-number | ip-address ip-address | mac-address mac-address | vlan vlan-id } * | all } [ verbose ] or display dhcpv6 static user-bind { { interface interface-type interface-number | ipv6-address { ipv6-address | all } | mac-address mac-address | vlan vlan-id } * | all } [ verbose ] command to check the static binding entries.
- Find out the interface and user host that initiate the attack. Check whether the host is attacked. If not, the host belongs to the attacker. Take measures to defend against the attack, for example, disconnect the attacker's host.
- Collect alarm and configuration information, and contact technical support personnel.
Related Information
None
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot