Message: connections per minute has exceeded the max limit

[maria.melendez]

Hello!

Today I noticed that I'm getting the following log message from the last couple of days:

%HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(250)as specified by the platform.

Last week, I updated a couple of 4506 switches with the following IOS 15.2(2) E3 and only 2 of them are not getting the log message. 

Can someone help me to troubleshoot this? 

Thank you!

[Seb Rupik · Accepted solution]

Hi there,

Either disable the HTTP server function:

!
no ip http server
no ip http secure-server
!

Or if you use the HTTP for administration purposes, apply an ACL to ensure that unwanted traffic is dropped:

!
ip http access-list <ACL_number>
!

cheers,

Seb.

[maria.melendez]

Thank you! Seb

[ashleystark]

So mine is doing the same thing but we don't manage switches from http at all. Any idea why all of a sudden request would kick off and fill up the log? I was troubleshooting issues an hour ago and now my log has nothing but this message:

Jun 15 11:21:27 EST: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.

I took your suggestion and "no" ed out those lines but is that the only thing ip http server controls?

device type: 3850 switch running denali 16.3.3

[justjoe]

OK removing HTTP from the switch soles a problem, the question is what causes it?  Is it a network breach?

In my case there were over 500 attempts or is it a bug?

%HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.

[Mark Malone]

Hi
Is someone scanning your network with a vulnerability scanner through HTTP , raid seven and mcaffe scanner cause this on my switches all the time
Its some software doing it , check with your security team , mine were the cause for me , they do it every week , the switch has a limit and the scanners can overrun it by constantly scanning by http
My switch below being scanned
Jan 13 01:52:46.024 UTC: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(250)as specified by the platform.

[AZZUNOCPROF]

You are right. Thanks, Mark.

[Roger Moore Jr]

You can use the "show ip http server connection" to see where the connections are originating