- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
GS324T - how to tune the DDoS (to avoid "false positives")
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
GS324T - how to tune the DDoS (to avoid "false positives")
Hi Netgear and Netgear fans,
Question: how to finetune the DDos?
the background for this question:
I've migrated part of the network to the GS324T (managed switch), and have left the Auto-DoS Mode Enabled.
Over the night (usually it happens during the night) one or another port gets disabled due to the potential DoS attack.
Based on the observation, it is primarily ports where WiFi access points are connected to.
What has caused this event, from what device MAC - it is not visible on the log, just one signle line:
<11> Apr 11 04:55:29 Main Home Switch-1 DOS[dtlTask]: dos_api.c(1928) 2115 %% ERR Interface g12 has been shutdown by DOS attack notification.
Is there any way to get more insights into the reason, that the settings could be "tuned" as I hope (believe) the event is a "false positive".
Thanks,
Andrey
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re: GS324T - how to tune the DDoS (to avoid "false positives")
As far as I have checked the GS324T user manual here, there is no option to further "tune" the settings on events or logs to be classified as a "false positive."
You may post your concern as feature request on the Idea Exchange for Business board here. In this way, the development team can see what feature does GS324T users wanted to be added to the functionality of the switch. Be informed that the more kudos given by community members to your feature request will help as the development team will be reviewing the post that has the most kudos and might get considered to be implemented.
Regards,
DaneA
NETGEAR Community Team
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re: GS324T - how to tune the DDoS (to avoid "false positives")
Hi DaneA,
Thanks for the suggestion. Feature has been requested --> link
In general, I'm a bit surprised to have this answer.
But ok, I'll be looking forward for further guidance and possibly a firmware update with this information being available in the log.
Regards, Andrey