Installation and Getting Started Guide
A - 28
Notification Local ICMP exceeds <burst-max> burst
packets, stopping for <lockup> seconds!!
The number of ICMP packets exceeds the
<burst-max> threshold set by the ip icmp
burst command. The HP device may be the
victim of a Denial of Service (DoS) attack.
All ICMP packets will be dropped for the
number of seconds specified by the
<lockup> value. When the lockup period
expires, the packet counter is reset and
measurement is restarted.
Notification Local TCP exceeds <burst-max> burst
packets, stopping for <lockup> seconds!!
The number of TCP SYN packets exceeds
the <burst-max> threshold set by the ip tcp
burst command. The HP device may be the
victim of a TCP SYN DoS attack.
All TCP SYN packets will be dropped for the
number of seconds specified by the
<lockup> value. When the lockup period
expires, the packet counter is reset and
measurement is restarted.
Notification Transit ICMP in interface <portnum>
exceeds <num> burst packets, stopping for
<num> seconds!!
Threshold parameters for ICMP transit
(through) traffic have been configured on an
interface, and the maximum burst size for
ICMP packets on the interface has been
exceeded.
The <portnum> is the port number.
The first <num> is the maximum burst size
(maximum number of packets allowed).
The second <num> is the number of
seconds during which additional ICMP
packets will be blocked on the interface.
Note: This message can occur in response
to an attempted Smurf attack.
Notification Local TCP exceeds <num> burst packets,
stopping for <num> seconds!!
Threshold parameters for local TCP traffic on
the device have been configured, and the
maximum burst size for TCP packets has
been exceeded.
The first <num> is the maximum burst size
(maximum number of packets allowed).
The second <num> is the number of
seconds during which additional TCP
packets will be blocked on the device.
Note: This message can occur in response
to an attempted TCP SYN attack.
Table A.2: HP Syslog Messages (Continued)
Message Level Message Explanation