DOS Attack alarm
Posted: 14 Nov 2015 10:28
Hi,
We keep getting these messages from time to time - at apparently random intervals and switches - our NOC then promptly informs us of the alarm - but since we have neither a way to stop what's going on - nor know what is causing it. I wonder - is there a way to disable this? Documentation seems to not tell me how to configure - just that the feature exists.
Ports that generate the alarm are unknown - but we use these switches to deliver triple play services - there is a CPE attached that is under our control.
One VLAN per customer- central 6850's is adding QinQ towards the SR-7 where the MSAP's are generated.
Alarm as seen in CA Spectrum:
Alarm URL : http://spectrumcl02/spectrum/oneclick.j ... h-adfs-342
Severity : Major
Date/Time : 13.nov.2015 22:56:04 CET
Name : switch-xyz
Network Address : 10.10.176.41
Secure Domain :
Type : AlcatelRT
Acknowledged : No
Alarm Title : DOS ATTACK ALARM
Landscape : spectrumcl02 (0x100000)
Event : An "alaDoSTrap" event has occurred, from GnSNMPDev device, named switch-xyz.
The sending agent has received a DoS attack.
alaDoSType = 9
alaDoSDetected = 91468
alaDoSIp = 192.168.113.1
alaDoSMac =
Question 1: What is going on? - Any tips as how to identify that?
Question 2: How do I disable just these traps, and not other traps that the switches will send.
We keep getting these messages from time to time - at apparently random intervals and switches - our NOC then promptly informs us of the alarm - but since we have neither a way to stop what's going on - nor know what is causing it. I wonder - is there a way to disable this? Documentation seems to not tell me how to configure - just that the feature exists.
Ports that generate the alarm are unknown - but we use these switches to deliver triple play services - there is a CPE attached that is under our control.
One VLAN per customer- central 6850's is adding QinQ towards the SR-7 where the MSAP's are generated.
Alarm as seen in CA Spectrum:
Alarm URL : http://spectrumcl02/spectrum/oneclick.j ... h-adfs-342
Severity : Major
Date/Time : 13.nov.2015 22:56:04 CET
Name : switch-xyz
Network Address : 10.10.176.41
Secure Domain :
Type : AlcatelRT
Acknowledged : No
Alarm Title : DOS ATTACK ALARM
Landscape : spectrumcl02 (0x100000)
Event : An "alaDoSTrap" event has occurred, from GnSNMPDev device, named switch-xyz.
The sending agent has received a DoS attack.
alaDoSType = 9
alaDoSDetected = 91468
alaDoSIp = 192.168.113.1
alaDoSMac =
Question 1: What is going on? - Any tips as how to identify that?
Question 2: How do I disable just these traps, and not other traps that the switches will send.