Virus Throttling
Connection-Rate Log and Trap Messages
■ Monitoring Shared Resources: Active instances of throttling or
blocking a client that is generating a high rate of connection requests
uses internal routing switch resources that are shared with several
other features. The routing switch provides ample resources for all
features. However, if the internal resources become fully subscribed,
new instances of throttling or blocking cannot be initiated until the
necessary resources are released from other uses. (Event Log
messages and SNMP traps are not affected.) For information on
determining current resource availability and usage, refer to the
appendix titled “Monitoring Resources” in the Management and
Configuration Guide for your switch.
Connection-Rate Log and Trap Messages
These messages appear in the switch’s Event Log. If SNMP trap receivers are
configured on the switch, it also sends the messages to the designated
receiver(s).
Message Meaning
Address not found in list of blocked Appears in the CLI when the vlan < vid > connection-
hosts.
rate-filter unblock
command has been executed to
unblock hosts that are not currently blocked.
W <
mm/dd/yy hh:mm:ss > virusfilt: Source IP A warning that results when a port configured for notify-
address < xxx.xxx.xxx.xxx > is exhibiting
only detects a relatively high number of connection-rate
virus-like behavior
attempts from a host.
W < mm/dd/yy hh:mm:ss > virusfilt: Source IP A warning and indication of the switch’s response when a
address
< xxx.xxx.xxx.xxx > has been throttled
port configured for throttle detects a relatively high
number of connection-rate attempts from a host.
W <
mm/dd/yy hh:mm:ss > virusfilt: Src IP A warning and indication of the switch’s response when a
< xxx.xxx.xxx.xxx > blocked
port configured for block detects a relatively high number
of connection-rate attempts from a host.
3-31
To Next Page
Loading...
Need help?
General
