%TCP-2-TCP_MAXESTABLISHED alert

bedevere.curry · ‎08-26-2007

Is there a way to verify if tcp established alert is at safe level? I can't seem to find the command to verify this. thx

thomas.anthony · ‎08-27-2007

%TCP-2-TCP_MAXESTABLISHED: Possible TCP ACK attack. Maximum established

The system counts the number of simultaneous open connections in SYN or EST states. When The count has exceeded the threshold, the system believes it is under a denial of service attack and this syslog message appears.

Recommended Action: Close traffic on the management port and determine the source of the denial of service attack.

The TCP-2-TCP_MAXESTABLISHED system message may appear during simultaneous webauth authentication with a large number of hosts.

This problem is resolved in software release 8.6(1). (CSCsf14780)