Cisco SNMP Message Processing DoS - 4513

[bfl1]

I'm seeing this signature many times a day coming from my 3640 dial up to my cisco works server. I enabled logging and looked at the traffic and it looks normal to me. Any one else seeing false positives on this one? Any one at Cisco willing to look at the IP Log and see if I'm missing something?

Thanks,

[milan.kulik]

Hi,

send an email to mcerha@cisco.com.

He is a member of Cisco IDS team.

I already provided him with some captured packets triggering false 4513 alarms.

Regards,

Milan

[mcerha]

There is a definite bug here. This is going to require a code change to properly detect the problem. I have filed DDTS CSCee50731 to track the issue. In the interim, I would recommend disabling this signature.

[rrussell]

I too am still seeing false positives on the 4513 sig. What is the status of the bug report, and is the recommended action still to disable the signature?

[scruggss]

I'm getting these as well, but the alarm is triggering on some Foundry routers running SNMPv3.