Flood Detection (8910001)
Hello.
Today I've visited LOG on my ZyWall 100, and saw warning lines:
Today I've visited LOG on my ZyWall 100, and saw warning lines:
Category: ADP
from Any to ZyWALL, [type=Flood-Detection(8910001)] TCP Flood TCP Flood Action: Block Severity: medium [count=2]
All of the floods are blocked, but there are thousands of strings in the LOG and CPU loads for 90%.
What Can I do? Give me suggestions, please.
All of the floods are blocked, but there are thousands of strings in the LOG and CPU loads for 90%.
What Can I do? Give me suggestions, please.
0
All Replies
-
Hi @follet,If it have large amount attack traffic continuously, we would suggest to disable the flooding log temporarily,because the device keep on writing the log, which will consume the CPU loading.
Assume those traffic have specific pattern, you also can try to block by IDP custom signature.
0
Categories
- All Categories
- 347 Beta Program
- 2.1K Nebula
- 114 Nebula Ideas
- 77 Nebula Status and Incidents
- 5K Security
- 44 USG FLEX H Series
- 246 Security Ideas
- 1.2K Switch
- 65 Switch Ideas
- 901 WirelessLAN
- 33 WLAN Ideas
- 5.8K Consumer Product
- 204 Service & License
- 326 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 1.8K FAQ
- 829 Nebula FAQ
- 401 Security FAQ
- 219 Switch FAQ
- 190 WirelessLAN FAQ
- 45 Consumer Product FAQ
- 136 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 71 About Community
- 61 Security Highlight