RIOS Syslog Messages for Attack Traffic

In addition to system level messages, all RIOS device will send their own independent syslog messages on DDoS attacks received on that device.

We generate a syslog when the attack packets/bytes for a victim crosses the following thresholds:   

• 100,000 attack packets or  
• 10,000,000 attack bytes.   

For each victim, there is a report for an end of attack when:   

• The victim is no longer under attack (at the point we are storing an end of attack timestamp), and  
• We have previously sent a start of attack syslog messages.   

This same threshold is applied for all Attack Types identified. The format of the syslog is:   

Zone: XYZ, Victim IP: a.b.c.d (vlan id XXX), ATTACK_TYPE attack detected.   

When the attack ends we will generate the following syslog for every victim for which we had generated a "attack detected" syslog. So, if we never generated the "start" syslog we will not generate the "end" syslog.   

Zone: XYZ, Victim IP: a.b.c.d (vlan id XXX), ATTACK_TYPE attack has ended.   

Attack type codes are listed on the Mitigation Config Tab.