× NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Orbi WiFi 7 RBE973
Reply

Re: GS324T - how to tune the DDoS (to avoid "false positives")

AndroGen
Guide

GS324T - how to tune the DDoS (to avoid "false positives")

Hi Netgear and Netgear fans,

Question: how to finetune the DDos?

the background for this question:

I've migrated part of the network to the GS324T (managed switch), and have left the Auto-DoS Mode Enabled.

Over the night (usually it happens during the night) one or another port gets disabled due to the potential DoS attack.

Based on the observation, it is primarily ports where WiFi access points are connected to.

What has caused this event, from what device MAC - it is not visible on the log, just one signle line: 

<11> Apr 11 04:55:29 Main Home Switch-1 DOS[dtlTask]: dos_api.c(1928) 2115 %% ERR Interface g12 has been shutdown by DOS attack notification.

Is there any way to get more insights into the reason, that the settings could be "tuned" as I hope (believe) the event is a "false positive".

Thanks,

Andrey

 

Message 1 of 3
DaneA
NETGEAR Employee Retired

Re: GS324T - how to tune the DDoS (to avoid "false positives")

@AndroGen,

 

As far as I have checked the GS324T user manual here, there is no option to further "tune" the settings on events or logs to be classified as a "false positive."

 

You may post your concern as feature request on the Idea Exchange for Business board here.  In this way, the development team can see what feature does GS324T users wanted to be added to the functionality of the switch. Be informed that the more kudos given by community members to your feature request will help as the development team will be reviewing the post that has the most kudos and might get considered to be implemented.

 

 

Regards,

 

DaneA

NETGEAR Community Team

Message 2 of 3
AndroGen
Guide

Re: GS324T - how to tune the DDoS (to avoid "false positives")

Hi DaneA,

 

Thanks for the suggestion. Feature has been requested --> link

In general, I'm a bit surprised to have this answer.

But ok, I'll be looking forward for further guidance and possibly a firmware update with this information being available in the log.

 

Regards, Andrey

Message 3 of 3
Top Contributors
Discussion stats
  • 2 replies
  • 1036 views
  • 1 kudo
  • 2 in conversation
Announcements