Forum Discussion
NimbostratusF5 LCD displaying "Blocking DOS attack"
Not sure if I'm posting this in the correct forum, apologies if not.
We have an Active/Standby cluster of 2 F5 Bigip 1600's running 9.4.7.
Recently we noticed the Standby F5 is displaying the following error on its LCD display:
"Critical: 9d Blocking Dos Attack"
[I'm assuming "9d" refers to 9 days because the number increases each day].
Is there anything I could or should be doing about this? I'm assuming this just means its doing its job and blocking a denial of service attack, however if I log into the web interface of the device there is nothing in the logs to indicate there is anything going on [I cant find any reference to a Dos attack].
The Active cluster member isn't displaying any errors [so I guess its targeted at the local IP address of the external interface of the Standby member?]
Should we just wait this out or can something be done about it? As far as I can tell its not affecting our network in any way [although we are having a weird problem with the VPN tunnels on our firewall cluster, but I think thats a coincidence].
Thanks in advance
16 Replies
What_Lies_Bene1Cirrostratus
I found these links on a post Hoolio had responded to back in 2011 that might help. The error is triggered when LTM runs low on memory. I suspect the standby is running low on memory due to a code bug and I'd suggest a reboot might fix this issue;
sol4611: Overview of adaptive reaping
http://support.f5.com/kb/en-us/solutions/public/4000/600/sol4611.html
sol7301: Protecting the BIG-IP LTM against denial of service attacks
http://support.f5.com/kb/en-us/solutions/public/7000/300/sol7301.html
biglouie_9849Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.
Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue?- biglouie_9849Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.
Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue? - biglouie_9849Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.
Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue? - biglouie_9849Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.
Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue? - biglouie_9849Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.
Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue? - What_Lies_Bene1Is the Status LED green or yellow, solid or blinking?
- biglouie_9849The status LED is solid yellow
- What_Lies_Bene1OK, so that's normal. So nothing in the logs on the device that indicates an issue?
- biglouie_9849In the System>Logs menu, the "System" tab shows "Configuration reload request received, reloading configuration" three times, the "Packet Filter", "Local Traffic" and "Audit" tabs all show "No records to display".
