Signature 4513 false alarms

[milan.kulik]

Hi,

I've just captured a correct SNMP packet (trap to port 162) which triggered a Cisco SNMP Message Processing DoS (4513) alarm.

My understanding was that only GET or SET packets sent to UDP 162 should trigger the alarm.

But this is a TRAP packet, i.e. correct network traffic!!!

Regards,

Milan

[umedryk]

You can clearly define which port should trigger the alarm. You can exclude if you give a range...

[milan.kulik]

Yes, but port 162 should trigger the alarm in the case there is a GET or SET sent to it!!!

It should NOT trigger an alarm when a TRAP is sent (which happens to me).

It seems like the RegexString being incorrect.

Regards,

Milan

[bfl1]

I'm seeing the same thing... normal traps are triggering the signature.