topic Too many active services. in Network Security

Too many active services.

Mariusz Bochen — Sun, 10 Mar 2019 12:52:55 GMT

I have a website with very high hit rate which is protected by IPS. There've been complains about some dropped request so I've gone through IPS Event Viewer and I found many of this:

evError: eventId=1321353761353146007 vendor=Cisco severity=error

originator:

hostId: xxx

appName: sensorApp

appInstanceId: 17803

time: xxx

errorMessage: Too many (2048) active services in external/tcp. Event for port [random_port_number] has been discarded name=errUnclassified

Does anyone know if this related and where/if amount of active services can be controlled?

Additional info:

Platform: WS-SVC-IDSM-2

Build Version: 7.0(6)E4

Bypass mode: auto

Any help will be much appreciated.

Regards

Mariusz

Too many active services.

sawgupta — Tue, 29 Jan 2013 03:58:59 GMT

As a workaround, you may disable anomaly-detection feature.

Regards,

Sawan Gupta

Too many active services.

Mariusz Bochen — Wed, 30 Jan 2013 12:31:16 GMT

Hi Sawan,

Thank you for reply.

I can't disable this feature because of security requirements.

After some further investigation the drop rate doesn't seem to be related to the errors on the IPS.

So the error is probably not affecting the website but is still interesting why I am getting these messages few times a day.

Does anyone has any idea?

Regards

Mariusz

Too many active services.

sawgupta — Thu, 31 Jan 2013 05:04:38 GMT

You receive this event becuase you have more than 2048 active service on a particular port.

Regards,

Sawan Gupta

Too many active services.

Mariusz Bochen — Mon, 04 Feb 2013 12:42:18 GMT

Hi Sawan,

Just to give you an update.

Probably type of traffic going through the IPS is too unpredictable, so after some internal discussions we've decided to disable anomaly detection feature.

I am monitoring the IPS and post the result soon.

Many thanks

Mariusz

Too many active services.

Mariusz Bochen — Wed, 06 Feb 2013 09:47:04 GMT

Hi Sawan,

After disabling anomaly-detection feature I am not getting discarded event errors any more.

Looks like this is not going to cause any harm so I am happy with the workaround.

Regards

Mariusz

Too many active services.

sawgupta — Sun, 10 Feb 2013 11:18:19 GMT

Good to know.

Thanks!

Sawan