Scanning log messages.

Russell Pearson · ‎12-10-2010

Hey There,

Can you guys look at these log messages and let me know what you think? Looks like my network is being scanned big time.

What's the best way to address this issue? Is there a way to find out if my ASA/company is being targetted?

Dec 10 2010 11:50:28: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 0 per second, max configured rate is 10; Current average rate is 12 per second, max configured rate is 5; Cumulative total count is 7315
Dec 10 2010 11:50:48: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 0 per second, max configured rate is 10; Current average rate is 12 per second, max configured rate is 5; Cumulative total count is 7303
Dec 10 2010 11:51:08: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 0 per second, max configured rate is 10; Current average rate is 12 per second, max configured rate is 5; Cumulative total count is 7299
Dec 10 2010 11:51:28: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 2 per second, max configured rate is 10; Current average rate is 11 per second, max configured rate is 5; Cumulative total count is 7160
Dec 10 2010 11:51:48: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 0 per second, max configured rate is 10; Current average rate is 11 per second, max configured rate is 5; Cumulative total count is 7090
Dec 10 2010 11:52:08: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 0 per second, max configured rate is 10; Current average rate is 10 per second, max configured rate is 5; Cumulative total count is 6147
Dec 10 2010 11:52:28: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 0 per second, max configured rate is 10; Current average rate is 8 per second, max configured rate is 5; Cumulative total count is 4962
Dec 10 2010 11:52:48: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 0 per second, max configured rate is 10; Current average rate is 7 per second, max configured rate is 5; Cumulative total count is 4567

Thank you.

mirober2 · ‎12-10-2010

Hello,

I responded to your first post here:

https://supportforums.cisco.com/message/3240840

Were you able to identify the traffic using 'show asp drop' and the ASP drop captures that I suggested? These captures will show you which packets are being dropped so you can identify the legitimacy of the traffic and find out where it's sourced from.

The ASA is already dropping the traffic, so if you want to stop it from reaching the ASA you would need to do this upstream or engage your ISP. If the traffic is legitimate, you can tweak the threat-detection thresholds.

-Mike

Russell Pearson · ‎12-10-2010

Here's the sh asp drop output.

ACU-ASA# sh asp drop

Frame drop:
Invalid encapsulation (invalid-encap)                                       84
No valid adjacency (no-adjacency)                                           21
Flow is denied by configured rule (acl-drop)                             91444
Invalid SPI (np-sp-invalid-spi)                                             54
NAT-T keepalive message (natt-keepalive)                                 32581
First TCP packet not SYN (tcp-not-syn)                                   15251
Bad TCP checksum (bad-tcp-cksum)                                             1
Bad TCP flags (bad-tcp-flags)                                                8
TCP data send after FIN (tcp-data-past-fin)                                324
TCP failed 3 way handshake (tcp-3whs-failed)                             31498
TCP RST/FIN out of order (tcp-rstfin-ooo)                                24942
TCP SEQ in SYN/SYNACK invalid (tcp-seq-syn-diff)                            30
TCP packet SEQ past window (tcp-seq-past-win)                             1024
TCP invalid ACK (tcp-invalid-ack)                                         1422
TCP Out-of-Order packet buffer full (tcp-buffer-full)                    19315
TCP Out-of-Order packet buffer timeout (tcp-buffer-timeout)              10338
TCP RST/SYN in window (tcp-rst-syn-in-win)                                  40
TCP dup of packet in Out-of-Order queue (tcp-dup-in-queue)              626151
TCP packet failed PAWS test (tcp-paws-fail)                               2334
IPSEC tunnel is down (ipsec-tun-down)                                      175
ICMP Inspect seq num not matched (inspect-icmp-seq-num-not-matched)          6
ICMP Error Inspect no existing conn (inspect-icmp-error-no-existing-conn)                                    25
DNS Inspect id not matched (inspect-dns-id-not-matched)                     25
Dropped pending packets in a closed socket (np-socket-closed)              293
Invalid ASDP packet received from SSM card (ssm-asdp-invalid)              104
Service module is down (ssm-app-fail)                                        3

Last clearing: 15:08:21 PST Dec 8 2010 by enable_15

Flow drop:
Flow closed by inspection (closed-by-inspection)                             4
NAT failed (nat-failed)                                                      6
Need to start IKE negotiation (need-ike)                                 20442
Inspection failure (inspect-fail)                                          224
SSL bad record detected (ssl-bad-record-detect)                            192
SSL handshake failed (ssl-handshake-failed)                                191
SSL malloc error (ssl-malloc-error)                                          1
SSL received close alert (ssl-received-close-alert)                         12

Last clearing: 15:08:21 PST Dec 8 2010 by enable_15
ACU-ASA#

Russell Pearson · ‎12-10-2010

So once I do ACU-ASA# capture drop type asp-drop all command, then I do a 'show asp drop' and 'show capture drop' . What command do I use to stop the capture?

cadet alain · ‎12-10-2010

Hi,

take a look here: http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml#sol6

Regards.

Don't forget to rate helpful posts.

Kureli Sankar · ‎12-11-2010

Hello russeeeeccna,

TCP failed 3 way handshake (tcp-3whs-failed) counter is pretty high. You need to issue "clear asp drop" and then immediately issue "sh asp drop" to see which counter in particular is increasing and then gather captures for that particular counter.

for example:

cap capasp type asp-drop tcp-3whs-failed

sh cap capasp.

This will provide you with source ip address details. With this you can reach out to your ISP and ask them to block this if it is coming from the outside or address the host(s) if it is within your network.

-KS

Russell Pearson · ‎12-13-2010

How long does the capture run and what command stops it?

Kureli Sankar · ‎12-13-2010

Capture will run until the default buffer size 256K is full and will not collect any more packets once the buffer is full unless you issue "clear cap capasp".

You can issue " sh cap capasp" and see what IP addresses show. ONce you done you can remove the capture with the command "no cap capasp"

-KS