No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

E9000 Server V100R001 HMM Alarm Handling 19

This document describes E9000 server alarms in terms of the meaning, impact on the system, possible causes, and solutions.
Rate and give feedback :
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
LDM

LDM

LDM_1.3.6.1.4.1.2011.5.25.165.1.11.5 hwBaseSecurityMaDiscardedRateRising

Description

The number of packets discarded for application and management defend exceeds the alarm threshold, and an alarm is generated. (ChassisID=[ChassisID], SlotID=[SlotID], Protocol=[Protocol], CurrentRateLow=[CurrentRateLow], CurrentRateHigh=[CurrentRateHigh], NotifyEnabled=[NotifyEnabled], RateThreshold=[RateThreshold], RateInterval=[RateInterval], Reason=[Reason])

The rate at which packets attacking the application and management plane were discarded exceeded the alarm threshold.

Attribute

Attribute

Description

Trap OID

1.3.6.1.4.1.2011.5.25.165.1.11.5

Trap severity

Warning

Match trap

LDM_1.3.6.1.4.1.2011.5.25.165.1.11.6 hwBaseSecurityMaDiscardedRateResume

Parameters

Parameter

Description

ChassisID

Chassis ID

SlotID

Stack ID

Protocol

Protocol description

CurrentRateLow

Lower 32 bits of the current count

CurrentRateHigh

Higher 32 bits of the current count

NotifyEnabled

Alarm status

RateThreshold

Alarm threshold

RateInterval

Interval at which alarms are generated

Reason

Alarm cause

Impact on the System

The application and management plane of thedevice is attacked by invalid packets, and the packets have been discarded. Therefore, services on the device are not affected.

Possible Causes

Cause 1: The application and management plane of the device were attacked by a flood of invalid packets, and the rate at which the packets were discarded exceeded the alarm threshold.

Procedure
  • Cause 1: The application and management plane of the device were attacked by a flood of invalid packets, and the rate at which the packets were discarded exceeded the alarm threshold.
    1. Collect information about configurations, trap messages, and log messages, and then contact Huawei technical support personnel.

LDM_1.3.6.1.4.1.2011.5.25.165.1.11.6 hwBaseSecurityMaDiscardedRateResume

Description

The number of packets discarded for application and management defend is restored, and an alarm is eliminated. (ChassisID=[ChassisID], SlotID=[SlotID], Protocol=[Protocol], CurrentRateLow=[CurrentRateLow], CurrentRateHigh=[CurrentRateHigh], NotifyEnabled=[NotifyEnabled], RateThreshold=[RateThreshold], RateInterval=[RateInterval])

The rate at which packets attacking the application and management planes were discarded fell below the alarm threshold.

Attribute

Attribute

Description

Trap OID

1.3.6.1.4.1.2011.5.25.165.1.11.6

Trap severity

Warning

Match trap

LDM_1.3.6.1.4.1.2011.5.25.165.1.11.5 hwBaseSecurityMaDiscardedRateRising

Parameters

Parameter

Description

ChassisID

Chassis ID

SlotID

Stack ID

Protocol

Protocol description

CurrentRateLow

Lower 32 bits of the current count

CurrentRateHigh

Higher 32 bits of the current count

NotifyEnabled

Alarm status

RateThreshold

Alarm threshold

RateInterval

Interval at which alarms are generated

Impact on the System

None.

Possible Causes

Cause: The rate at which packets attacking the application and management planes were discarded fell below the alarm threshold.

Procedure
  • Cause: The rate at which packets attacking the application and management planes were discarded fell below the alarm threshold.
    1. This alarm message indicates a normal situation, and no action is required.

LDM_1.3.6.1.4.1.2011.5.25.165.1.11.3 hwBaseSecurityTcpIpAttackDiscardedRateRising

Description

The number of packets discarded for TCP/IP defend exceeds the alarm threshold, and an alarm is generated. (ChassisID=[ChassisID], SlotID=[SlotID], Protocol=[Protocol], CurrentRateLow=[CurrentRateLow], CurrentRateHigh=[CurrentRateHigh], NotifyEnabled=[NotifyEnabled], RateThreshold=[RateThreshold], RateInterval=[RateInterval], Reason=[Reason])

The rate at which malformed TCP/IP packets were discarded exceeded the alarm threshold.

Attribute

Attribute

Description

Trap OID

1.3.6.1.4.1.2011.5.25.165.1.11.3

Trap severity

Warning

Match trap

LDM_1.3.6.1.4.1.2011.5.25.165.1.11.4 hwBaseSecurityTcpIpAttackDiscardedRateResume

Parameters

Parameter

Description

ChassisID

Chassis ID

SlotID

Stack ID

Protocol

Protocol description

CurrentRateLow

Lower 32 bits of the current count

CurrentRateHigh

Higher 32 bits of the current count

NotifyEnabled

Alarm status

RateThreshold

Alarm threshold

RateInterval

Interval at which alarms are generated

Reason

Alarm cause

Impact on the System

The device is attacked by malformed TCP/IP packets, and the packets have been discarded. Therefore, services on this device are not affected.

Possible Causes

Cause 1: The device was attacked by a flood of malformed TCP/IP packets, and the rate at which the packets were discarded exceeded the alarm threshold.

Procedure
  • Cause 1: The device was attacked by a flood of malformed TCP/IP packets, and the rate at which the packets were discarded exceeded the alarm threshold.
    1. Collect information about configurations, trap messages, and log messages, and then contact Huawei technical support personnel.

LDM_1.3.6.1.4.1.2011.5.25.165.1.11.4 hwBaseSecurityTcpIpAttackDiscardedRateResume

Description

The number of packets discarded for TCP/IP defend is restored, and an alarm is eliminated. (ChassisID=[ChassisID], SlotID=[SlotID], Protocol=[Protocol], CurrentRateLow=[CurrentRateLow], CurrentRateHigh=[CurrentRateHigh], NotifyEnabled=[NotifyEnabled], RateThreshold=[RateThreshold], RateInterval=[RateInterval])

The rate at which malformed TCP/IP packets were discarded fell below the alarm threshold.

Attribute

Attribute

Description

Trap OID

1.3.6.1.4.1.2011.5.25.165.1.11.4

Trap severity

Warning

Match trap

LDM_1.3.6.1.4.1.2011.5.25.165.1.11.3 hwBaseSecurityTcpIpAttackDiscardedRateRising

Parameters

Parameter

Description

ChassisID

Chassis ID

SlotID

Stack ID

Protocol

Protocol description

CurrentRateLow

Lower 32 bits of the current count

CurrentRateHigh

Higher 32 bits of the current count

NotifyEnabled

Alarm status

RateThreshold

Alarm threshold

RateInterval

Interval at which alarms are generated

Impact on the System

None.

Possible Causes

Cause 1: The rate at which malformed TCP/IP packets were discarded fell below the alarm threshold.

Procedure
  • Cause 1: The rate at which malformed TCP/IP packets were discarded fell below the alarm threshold.
    1. This alarm message indicates a normal situation, and no action is required.

LDM_1.3.6.1.4.1.2011.5.25.165.2.2.1.2 hwStrackIfVlanInfo

Description

Attack occurred. (Interface=[Interface], CVLAN=[CVLAN], PVLAN=[PVLAN], EndTime=[EndTime], TotalPackets=[TotalPackets])

The system detected attacks on an interface.

Attributes

Attribute

Description

Trap OID

1.3.6.1.4.1.2011.5.25.165.2.2.1.2

Trap severity

Warning

Parameters

Parameter

Description

Interface

Interface index

CVLAN

Inner VLAN tag of an attack packet sent by a user

PVLAN

Outer VLAN tag of an attack packet sent by a user

EndTime

Time when the last attack packet is received

TotalPackets

Number of received attack packets

Impact on the System

The CPU is too busy processing attack packets that some normal packets are not processed in a timely manner or even dropped.

Possible Causes

The rate at which packets were sent by a user (Interface + VLAN) to the CPU exceeded the alarm threshold.

Procedure
  • The rate at which packets were sent by a user (Interface + VLAN) to the CPU exceeded the alarm threshold.
    1. Run the display auto-defend attack-source detail command to check potential attack sources and to determine whether the packet transmission rate is abnormal.
      • If the packet transmission rate is abnormal, go to Step 2.
      • If the packet transmission rate is normal, go to Step 7.
    2. Check the number of users on the interface that receives attack packets.
      • If there is only one user, go to Step 3.
      • If there are multiple users, go to Step 5.
    3. Check whether this user sent the attack packets.
      • If this user sent the attack packets, go to Step 4.
      • If this user did not send the attack packets, go to Step 7.
    4. Run the shutdown command to shut down the interface. Then, check whether the alarm is cleared. If the alarm persists, go to Step 7.
    5. Check whether one of the users sent the attack packets.
      • If one of the users sent the attack packets, go to Step 6.
      • If none of the users sent the attack packets, go to Step 7.
    6. Add the user who sent attack packets to a blacklist and check whether the fault is rectified. If the fault persists, go to Step 7.
    7. Collect trap, log, and configuration information, and contact Huawei technical support personnel.

LDM_1.3.6.1.4.1.2011.5.25.165.2.2.1.5 hwStrackIpInfo

Description

Attack occurred. (Interface=[Interface], SourceIp=[SourceIp], CVLAN=[CVLAN], PVLAN=[PVLAN], EndTime=[EndTime], TotalPackets=[TotalPackets])

The system detected attacks from a user with a specified source IP address.

Attributes

Attribute

Description

Trap OID

1.3.6.1.4.1.2011.5.25.165.2.2.1.5

Trap severity

Warning

Parameters

Parameter

Description

Interface

Interface index

SourceIp

Source IP address

CVLAN

Inner VLAN tag of an attack packet sent by a user

PVLAN

Outer VLAN tag of an attack packet sent by a user

EndTime

Time when the last attack packet is received

TotalPackets

Number of received attack packets

Impact on the System

The CPU is too busy processing attack packets that some normal packets are not processed in a timely manner or even dropped.

Possible Causes

The rate at which packets were sent by a user (a source IP address) to the CPU exceeded the alarm threshold.

Procedure
  • The rate at which packets were sent by a user (a source IP address) to the CPU exceeded the alarm threshold.
    1. Run the display auto-defend attack-source detail command to check potential attack sources and to determine whether the packet transmission rate is abnormal.
      • If the packet transmission rate is abnormal, go to Step 2.
      • If the packet transmission rate is normal, no action is required.
    2. Add the user who sent attack packets to a blacklist in the cpu-defend policy template so that the system will not send packets from this user to the CPU. Then, check whether the fault is rectified. If the fault persists, go to Step 3.
    3. Collect trap, log, and configuration information, and contact Huawei technical support personnel.

LDM_1.3.6.1.4.1.2011.5.25.165.2.2.1.1 hwStrackUserInfo

Description

Attack occurred. (Interface=[Interface], SourceMAC=[SourceMAC], CVLAN=[CVLAN], PVLAN=[PVLAN], EndTime=[EndTime], TotalPackets=[TotalPackets])

The system detected attacks from a user with a specified source MAC address.

Attributes

Attribute

Description

Trap OID

1.3.6.1.4.1.2011.5.25.165.2.2.1.1

Trap severity

Warning

Parameters

Parameter

Description

Interface

Interface index

SourceMAC

Source MAC address

CVLAN

Inner VLAN tag of an attack packet sent by a user

PVLAN

Outer VLAN tag of an attack packet sent by a user

EndTime

Time when the last attack packet is received

TotalPackets

Number of received attack packets

Impact on the System

The CPU is too busy processing attack packets that some normal packets are not processed in a timely manner or even dropped.

Possible Causes

The rate at which packets were sent by a user (MAC + VLAN) to the CPU exceeded the alarm threshold.

Procedure
  • The rate at which packets were sent by a user (MAC + VLAN) to the CPU exceeded the alarm threshold.
    1. Run the display auto-defend attack-source detail command to check potential attack sources and to determine whether the packet transmission rate is abnormal.
      • If the packet transmission rate is abnormal, go to Step 2.
      • If the packet transmission rate is normal, no action is required.
    2. Add the user who sent attack packets to a blacklist in the cpu-defend policy template so that the system will not send packets from this user to the CPU. Then, check whether the fault is rectified. If the fault persists, go to Step 3.
    3. Collect trap, log, and configuration information, and contact Huawei technical support personnel.
Translation
Download
Updated: 2018-08-16

Document ID: EDOC1000015902

Views: 215840

Downloads: 1596

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next