topic Re: ASA 5510 in Network Security

ASA 5510

hunnetvl01 — Mon, 11 Mar 2019 15:02:13 GMT

All-

What is this message I see in the fws log?

[ Scanning] drop rate-1 exceeded.

Thanks,

Vlad

Re: ASA 5510

Yudong Wu — Mon, 09 Mar 2009 20:57:41 GMT

Please check the following link for the explannation.

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4963969

Re: ASA 5510

Yudong Wu — Mon, 09 Mar 2009 21:04:12 GMT

By the way "scanning drop" includes:

ACL drop, Bad packet drop, Conn limit drop, ICMP drop, Inspect drop, Interface drop and Syn attack.

Re: ASA 5510

hunnetvl01 — Tue, 10 Mar 2009 13:21:03 GMT

is there a way I can check what hosts were previously shunned if now I cant see any.

I have the log which says rate exceeded but I want to see which were the shunned hosts.

I cant see any with sh threat-detection shun

Thanks,

Re: ASA 5510

renatoaureliano — Fri, 17 Feb 2012 15:01:26 GMT

I'm receiving the same messages on log:

[ Scanning] drop rate-1 exceeded. Current burst rate is 10 per second, max configured rate is 10; Current average rate is 9 per second, max configured rate is 5; Cumulative total count is 5622

[ Scanning] drop rate-2 exceeded. Current burst rate is 8 per second, max configured rate is 8; Current average rate is 8 per second, max configured rate is 4; Cumulative total count is 31781

[ Scanning] drop rate-1 exceeded. Current burst rate is 10 per second, max configured rate is 10; Current average rate is 9 per second, max configured rate is 5; Cumulative total count is 5915

[ Scanning] drop rate-2 exceeded. Current burst rate is 8 per second, max configured rate is 8; Current average rate is 8 per second, max configured rate is 4; Cumulative total count is 31911

[ Scanning] drop rate-1 exceeded. Current burst rate is 10 per second, max configured rate is 10; Current average rate is 9 per second, max configured rate is 5; Cumulative total count is 5915

It happens all the time.

It doesn't show the source or destination.

I'm using ASDM 6.1 - ASA 5510

How can I avoid this messagens and protect from this scanning attacks?

Thank's,

Renato

ASA 5510

renatoaureliano — Fri, 17 Feb 2012 19:31:49 GMT

Found Solution for drop rate-1:

https://supportforums.cisco.com/thread/228276

The syslogs "[ Scanning] drop rate-1 exceeded." mean the you have exceeded the "Scanning attack detected" threshold.

Shows a threshold that you exceeded.

But threat detection will not drop unless you tell it to.

The default behavior is to just alert (generate syslog).

So I would like to know if drop rate-2 is the same.

Thank's.