DoS troubleshooting

Execute show dospreventionprofile <dos-measure-name> <inbound/outbound> in the Sensor.

Trace the Sensor files.

Check for the source IP of the profile learning each of the packet types. Execute the following commands:

Check the bins for long-term average traffic rate and short-term average traffic rate values. An alert is raised when the short-term traffic rate is higher than the long-term traffic rate.

Check bins that are blocked. A sample of the source IP profile during the detection stage which indicates the blocked bins is shown in the figure.

If many DoS alerts are raised frequently for a particular IP, it could be false positive. The reason could be due to the profile of that IP not studied properly.

For volume related alerts (for example, if the inbound UDP volume is too high), check if the IP is missing in the alert details. To check the alert details, navigate to Analysis → <Admin Domain Name> → Attack Log and select the alert by clicking on it twice.

Click Devices → <Domain Name> → Devices → <Device Name> → Troubleshooting → Denial of Service → Data Management.

In the DoS Profile Learning section, select Rebuild the DoS Profiles.

Click Update.