Hot to configure sanity-checks ?

[Jack Lu]

Hi All

I went through the support files  and found such kind of log messages during peak hours as below,

2010-07-11 11:55:47 | INFO  | CPU #000 | Started filtering packets of type 'TCP Non-SYN' received on interface # 0. Reason: Started filtering due to attack detection

2010-07-11 12:00:35 | INFO  | CPU #000 | Started filtering packets of type 'TCP No-SYN + RST' received on interface # 0. Reason: Started filtering due to attack detection

2010-07-11 13:07:25 | INFO  | CPU #000 | Stopped filtering packets of type 'TCP No-SYN + RST' received on interface # 0. Reason: Stopped filtering for an administrative pause

Basically those logs mean that SCE detect attacks and then in order to protect itself, it put those attack traffic in filter, one hour later, SCE remove the flows from filter and check again, if attack persist, SCE put attack traffic in filter again.

Could we decrease the time for filtering traffic ? like 10 minutes ?

[cfistik]

Hello,

I believe this is what you're looking for:

SCE8000#>configure
SCE8000(config)#>interface LineCard 0
SCE8000(config if)#>sanity-checks attack-filter times filtering-cycle max-attack-time

SCE8000#>show interface LineCard 0 sanity-checks attack-filter times
Filtering cycle: 3600 seconds.
Max attack time: 86400 seconds.

Hope that helps,

Best regards.