topic Error messages on ASA in Network Security

Error messages on ASA

rehan_uet — Mon, 11 Mar 2019 23:07:29 GMT

I see following message very frequent on ASA ASDM Syslog messages window; what could be possible reason of these messages and what is the remedy to it.

[ Scanning] drop rate-1 exceeded. Current burst rate is 42 per second, max configured rate is 10; Current average rate is 60 per second, max configured rate is 5; Cumulative total count is 36350

Error messages on ASA

Marcin Latosiewicz — Tue, 15 May 2012 17:17:26 GMT

those are produced by threat detection features.

show run all threat-detection

will all you to see all settings.

Error messages on ASA

rehan_uet — Tue, 15 May 2012 17:18:55 GMT

Should I ignore these messages?

Error messages on ASA

Marcin Latosiewicz — Tue, 15 May 2012 17:25:53 GMT

That's up to you 🙂

The defaults are pretty OK, but it's hard to configure something that would be optimal for everyone.

More info:

http://www.cisco.com/en/US/docs/security/asa/asa84/system/message/logmsgs.html#wp4963969

Error messages on ASA

rehan_uet — Tue, 15 May 2012 17:28:38 GMT

My understanding is there is no harm of these messages and these messages just give the alert about attack; am I correct?

Error messages on ASA

Marcin Latosiewicz — Tue, 15 May 2012 17:35:54 GMT

It's not only that.

There is certain level of "inteligence" built into TD that should catch detect attack.

But riddle me this, how is TD supposed to differentiate between an actual attack and a misconfigured network device flooding/looping packets.

A typical scenario I saw causing this, syslog/snmp packets sent through the firewall coincidentally were treated as an attack because of the amount of packets in short bursts. In this case the root cause turned out ot be ops personel setting logging level to high for some unrelated troubleshooting session and not setting it back.