Alert Messages on router

[jvandebogert]

We have debug logging on and we are getting this message about every minute. What is it and how can I see more detail about where it is coming from?

2004-10-18 14:24:15 Local7.Warning 192.168.100.1 10114327: 11w0d: %FW-4-ALERT_OFF: calming down, count (2/400) current 1-min rate: 399

 

[gtmoore]

According to Cisco:

Error Message

%FW-4-ALERT_OFF:[chars], count ([dec]/[dec]) current 1-min rate: [dec]
Explanation Either the number of half-open connections or the new connection initiation rate has gone below the max-incomplete low threshold. This message indicates that the rate of incoming new connections has slowed down and is issued only when the max-incomplete low threshold is crossed.

Recommended Action This message is for informational purposes only, but may indicate that an attack has stopped.

The following is an example of this type of message:

%FW-4-ALERT_OFF: calming down, count (0/400) current 1-min rate: 0


When %FW-4-ALERT_ON and %FW-4-ALERT_OFF error messages appear together, each "aggressive/calming" pair of messages indicates a separate attack. The following example shows two separate attacks:

%FW-4-ALERT_ON: getting aggressive, count (25/25) current 1-min rate: 103
%FW-4-ALERT_OFF: calming down, count (9/10)current 1-min rate: 108
%FW-4-ALERT_ON: getting aggressive, count (25/25) current 1-min rate: 99
%FW-4-ALERT_OFF: calming down, count (9/10)current 1-min rate: 99


The following error messages may indicate that a denial-of-service attack has occurred on a specific TCP host:

website:

http://cisco.com/en/US/products/sw/iosswrel/ps1826/products_feature_guide09186a0080080f4d.html