High volume of DoS learning attack detected after sensor rebooting/upgrading

Technical Articles ID: KB91581
Last Modified: 2024-01-22 11:21:29 Etc/GMT

Environment

Trellix Intrusion Prevention System (Trellix IPS)

Problem

When you reboot your Sensor, you see a high volume of DoS learning attacks detected, such as the following:

Inbound TCP SYN or FIN Volume Too High
TCP Control Segment Anomaly

If you view the DoS profile, you might see the following output:

show dospreventionprofile tcp-syn inbound

packet type: TCP-SYN IN (0), profile stage: normal operation (65)
long-term average rate=7793.464(pkts/s), last_rate=0.000(pkts/s)
not enough long-term traffic received to establish a reliable profile, blocking based on current traffic distribution only
percentage of 'good' traffic blocked (estimate)=0.0%
percentage of traffic blocked (total, estimate)=0.0%
each line: block_flag, bin_index, IP_prefix/prefix_len, AS(%), LT(%), ST(%), ltR(ate), stR(ate)
AS(%) -- percentage of the IP address space this bin occupies
LT(%) -- percentage of long-term traffic that falls into this bin
ST(%) -- percentage of short-term traffic that falls into this bin
ltRate -- long-term traffic rate (in pkts/s) for this bin
stRate -- short-term traffic rate (in pkts/s) for this bin
block flag meaning: * -- blocked due to low long-term traffic,
# -- blocked due to excessive current traffic, no flag -- not blocked

Cause

The not enough long-term traffic received to establish a reliable profile message is due to the nature or pattern of the local network traffic. A hard-coded mechanism monitors whether enough traffic has passed through the Sensor to determine if the profile is reliable. When the Sensor decides it's unreliable, the DoS profile isn't loaded into the local memory of the Sensor. This check runs when the Sensor is rebooting.

Solution

There are two options for recovery from this situation:

To keep the same profile, upload the profile file to the Manager and then download it back to the Sensor:

Click Devices, Devices, <Sensor Name>, Troubleshooting, Denial of Service, Data Management.
Select Upload a DoS Profile (device to Manager) and then click Update.
Select Upload and then click Upload DOS Profiles.
Close the window after the upload finishes.
Return to the Data Management page.
Click Restore a DoS Profile (Manager to device) and then click Update.
Select the profile you uploaded and then click Restore.
Close the window after the restore finishes.

These steps force the local memory to be initialized again with profile file data.

To rebuild the DoS profile from the beginning:

Click Devices, Devices, <Sensor Name>, Troubleshooting, Denial of Service, Data Management.
Click Rebuild the DoS Profiles (start the learning process from scratch) then click Update.

IMPORTANT: The Sensor transits to DoS Detection mode after 48 hours of learning.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

High volume of DoS learning attack detected after sensor rebooting/upgrading

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

High volume of DoS learning attack detected after sensor rebooting/upgrading

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title