MBR_1.3.6.1.4.1.2011.5.25.327.31.3.2.2 hwUniMbrASDiscoverAttack

Description

MBR/1/ASDISCOVERYATTACK: OID [oid] An AS discover packet attack is detected. (DeviceName=[OCTET], ASIndex=[INTEGER], Interface=[STRING], Rate(pps)=[INTEGER])

A fabric port was attacked by AS Discovery packets.

Attribute

Alarm ID	Alarm Severity	Alarm Type
1.3.6.1.4.1.2011.5.25.327.31.3.2.2	Critical	environmentalAlarm(6)

Parameters

Name	Meaning
oid	Indicates the MIB object ID of the alarm.
DeviceName	Indicates the device name.
ASIndex	Indicates the AS index.
Interface	Indicates the name of the local port.
Rate(pps)	Indicates the rate at which AS Discovery packets are received.

Impact on the System

The fabric port may not change to Up state and ASs may not go online.

Possible Causes

Unauthorized users sent a large number of AS Discovery packets to the fabric port.

Procedure

Obtain the device name and local connection port of the unauthorized user.
1. DeviceName in the alarm indicates the unauthorized device name.
2. Interface in the alarm indicates the local connection port name.
Disconnect the unauthorized user from the fabric port.
1. Run the display lldp neighbor brief command and find the topology in which the unauthorized user connects to the parent based on the local port name, local device name, and unauthorized device name.
2. Remove this unauthorized device based on the topology.

Related Information

None.