Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

strange error message in log

did find in documentation these type of messages

what is the meaning of these ?

thanks

JYP

04/09/2003 15:07:10UTC E ERROR - cannot specify both ChokeThreshold and AlarmInt

erval for SIGID 6901

04/09/2003 15:07:10UTC E ERROR - cannot specify both ChokeThreshold and AlarmInt

erval for SIGID 6902

04/09/2003 15:07:10UTC E ERROR - cannot specify both ChokeThreshold and AlarmInt

erval for SIGID 6903

04/09/2003 15:07:10UTC E ERROR - cannot specify both ChokeThreshold and AlarmInt

erval for SIGID 6910

04/09/2003 15:07:10UTC E ERROR - cannot specify both ChokeThreshold and AlarmInt

erval for SIGID 6920

04/09/2003 16:10:39UTC E ERROR - cannot specify both ChokeThreshold and AlarmInt

erval for SIGID 6901

  • Other Security Subjects
3 REPLIES
Bronze

Re: strange error message in log

It is the 69xx series signatures. These

encompass five (NET FLOOD ICMP/TCP/UDP) sigs that are supposed to aid

in detecting DoS attempts.

Cisco Employee

Re: strange error message in log

It looks like these signatures have been mistuned. ChokeThreshold

and AlarmInterval are signature parameters that control when an alert

is sent after the signature fires. Normally you would set either one,

or the other, or neither. But there is no configuration where it is

legal to set both.

AlarmInterval is used when you want the alert to be

sent only after the signature has fired a specified number of times

(MinHits) during a specified interval in seconds (AlarmInterval). If you

choose to do this, then do not set ChokeThreshold, or set it to ANY if

the management platform allows this option.

ChokeThreshold is used if you want the sensor to modify the

way it sends alerts when the signature firing rate starts increasing.

For example, suppose a signature is configured to send an alert

each time the signature fires (AlarmThrottle=FireAll). Then you can

optionally configure the sensor to only send a summary alert if

the signature firing rate increases beyond a specified threshold

value (ChokeThreshold) during a specified number of seconds

(ThrottleInterval). If you choose to do this, then AlertInterval should

not be set, and MinHits should be set to 1.

New Member

Re: strange error message in log

many thanks for this deeper information

JYP

99
Views
5
Helpful
3
Replies