Tue 20 Aug 2019 13:42:58 UTC
DoS Host Alert 84961
Duration: Aug 20 09:16 - 09:50 (0:34)
DETAILS Period: Alert Timeframe Units: bps View: Network Boundary
Summary
Severity Level: Max Severity Percent: Max Impact of Alert Traffic: Direction: Misuse Types: Managed Object: Target:
High 205.0% of 10 Kpps 8.4 Mbps/20.5 Kpps Incoming TCP SYN, TCP RST Michnet1 198.108.67.16
Top Misuse Type: TCP SYN at Managed Object Boundary
Alert Traffic * Misuse Types Exceeding Trigger Rate
All Alert Traffic TCP SYN * TCP RST *
25.88 Kpps 1
25.00 Kpps
20.00 Kpps 0.5
15.00 Kpps
0
10.00 Kpps
-0.5
5.00 Kpps
0.00
0.00 pps
pps -1
-1
09:16:00 09:20:00 09:23:20 09:26:40 09:30:00 09:33:20 09:36:40 09:40:00 09:43:20 09:46:40 09:50:00
Alert Characterization Packet Size Distribution
Misuse Types TCP SYN (5) 82.47% 0-150
151-300
Source IP Addresses Highly Distributed 100.00% 301-450
Destination IP Addresses 198.108.67.16/32 100.00% 451-600
601-750
Protocols tcp (6) 100.00% 751-900
Source TCP Ports 1024-65535 (Dynamic) 99.58% 901-1050
1051-1200
Destination TCP Ports 80 (www-http) 63.27% 1201-1350
Destination TCP Ports 443 (https) 1351-1500
36.30%
jumboframes
Source Countries Russian Federation 72.86% 0 20M 33.58M
Destination ASNs NULL (0) 100.00% packets
TCP Flags S (Synchronize) 82.47%
Top Traffic Patterns (last 5 min of selected timeframe)
No patterns found in the last 5 minutes of the selected timeframe.
page 1 of 5
Traffic Details
No patterns found in the last 5 minutes of the selected timeframe.
Top 5 for Each Traffic Statistic
Source IP Addresses
Highly Distributed 15.99 Kpps 100.00%
178.0.0.0/8 233.00 pps 1.46%
95.71.176.4/32 194.00 pps 1.21%
46.0.0.0/8 108.00 pps 0.68%
95.46.145.104/32 104.00 pps 0.65%
Destination IP Addresses
198.108.67.16/32 15.99 Kpps 100.00%
Source TCP Ports
1024-65535 Dynamic 15.92 Kpps 99.58%
80 www-http 58.00 pps 0.36%
53836 2.00 pps 0.01%
65095 1.00 pps 0.01%
62022 1.00 pps 0.01%
page 2 of 5
Destination TCP Ports
80 www-http 10.12 Kpps 63.27%
443 https 5.80 Kpps 36.30%
8968 0.00 pps
53481 0.00 pps
55602 0.00 pps
Source UDP Ports
No items available.
Destination UDP Ports
No items available.
Source ASNs
12389 ROSTELECOM 3.83 Kpps 23.98%
6697 BELPAK 594.00 pps 3.72%
8402 CORBINA 360.00 pps 2.25%
15895 KSNET 229.00 pps 1.43%
28812 JSCBIS 217.00 pps 1.36%
page 3 of 5
Destination ASNs
0 NULL 15.99 Kpps 100.00%
Source Countries
Russian Federation 11.65 Kpps 72.86%
Ukraine 2.83 Kpps 17.71%
Belarus 642.00 pps 4.02%
Kazakhstan 375.00 pps 2.35%
Unknown 88.00 pps 0.55%
Protocols
tcp 15.99 Kpps 100.00%
TCP Flags
S Synchronize 13.19 Kpps 82.47%
AR Acknowledgement, Reset 2.27 Kpps 14.21%
Acknowledgement...
R Reset 530.00 pps 3.31%
page 4 of 5
ICMP Types
No items available.
Misuse Types
TCP SYN 13.19 Kpps 82.47%
TCP RST 2.80 Kpps 17.53%
Routers
Name (# Interfaces) Severity Interface Direction Interface Boundary Interface ASNs Avg Packet Size Max Observed Average Observed
wsu5 (2) - - - 49 10.1 Mbps 6.2 Mbps
High 25.5 Kpps 15.7 Kpps
ae3.28 OUT 49 10.1 Mbps 6.2 Mbps
WSU5-to-SFLD-COR-123NET-MPLS-BIN-PTP
25.5 Kpps 15.7 Kpps
WSU5-to-SFLD-COR...PTP
et-5/1/0.0 IN Network 7018 49 10.1 Mbps 6.2 Mbps
AT&T-MIS 100GE;/L8YX/958242//ATI/ (LR4,TX=0,RX=0, DTRT-WSUCC-PD3)
25.5 Kpps 15.7 Kpps
100GE;/...D3)
AT&T-MIS
Annotations
Alert Classification None
The "TCP SYN" host alert signature severity rate configured for "Michnet1" has been exceeded for 3 minutes, changing Severity Level from medium to high (expected rate: 10.00 Kpps, observed rate: 15.67 Kpps) (boundary: managed
object)
auto-annotation on Tue Aug 20 9:18:45
The "TCP SYN" host alert signature severity rate configured for "Michnet1" has been exceeded, changing Severity Level from low to medium (expected rate: 10.00 Kpps, observed rate: 11.21 Kpps)
auto-annotation on Tue Aug 20 9:16:45
The "TCP RST" host alert signature has been triggered at router "wsu5". (expected rate: 2.50 Kpps, observed rate: 2.69 Kpps)
auto-annotation on Tue Aug 20 9:16:45
The "TCP SYN" host alert signature has been triggered at router "wsu5". (expected rate: 2.50 Kpps, observed rate: 11.21 Kpps)
auto-annotation on Tue Aug 20 9:16:45
For assistance with this product, please contact support at https://support.arbornetworks.com
page 5 of 5
