Matrix N-Series DFE
Network virus or DOS Attack
Too many flows/connections being rapidly created
Flow Limiting - also known as Flow Setup Throttling (FST) - is not working
Too many flows on the network
Flow Limiting (5289) should ideally be used on user edge ports only, as this is where the issue tends to originate. Creating too many flow monitors at the core of a network, and dropping flows or disabling ports in the core, is not an optimal design. Certainly, actions taken on InterSwitch Link (ISL) ports can be painful to recover. Well-implemented networks will start by looking at normal flow levels in order to determine the most useful limits.
- Apply a reasonable limiter to individual ports.[list]
According to the baselined results of these queries (especially the 'show flowlimit stats') over time, the user should adjust limit2 to be perhaps 50-100% higher than the highest count seen, and then adjust limit1 to be just above the highest count seen. The idea is to only involve management when an event worthy of examination has occurred. These numbers will vary according to how the port is used, which is why it is possible to utilize different traffic classes (userport, serverport, aggregateduser, interswitchlink) for this purpose. If a 'show flowlimit port' indicates that a triggered flow limit has disabled ports (this might only happen if the desired action is disable), then once the attack or issue is corrected the port may be re-enabled:
In the absence of a legitimate configuration for this purpose, the user may for example configure a dummy L4 classification which is neither statically nor dynamically applied to traffic:
Also see this HowTo Video demonstrating the flowlimit command set using S-Series firmware 8.01.01.0016.
See also: 5116.