WSM Reference Guide - WatchGuard Technologies

Alarm LogsDenial of Servce (DoS) AlarmsDefaultNameDOSMessage Format Example Message Caused Byalarm_name detected.message_string.NOTE: The content of this alarmmessage is based on what DOSevent triggered it. See theexamples below.These alarms aretriggered by any DOSevents.SYN-Attackalarm _ame detected. TCP SYNattack detected on interfaceinterface_number.”SYN-Attack detected. TCP SYNattack detected on interface 1.These alarms aretriggered by SYN attacks.UDP-Floodalarm _name detected. UDP Floodattack detected on interfaceinterface_number.UDP-Flood detected. UDP Floodattack detected on interface 1.These alarms aretriggered by UDP Floodattacks.ICMP-Floodalarm_name detected. ICMP Floodattack detected on interfaceinterface_number.ICMP-Flood detected. ICMP Floodattack detected on interface 1.These alarms aretriggered by ICMP Floodattacks.Ping-of-Deathalarm_name detected, PING-OF-DEATH attack detected on interfaceinterface_number.Ping-of-Death detected. PING-OF-DEATH attack detected on interface1.These alarms aretriggered by Ping-of-Death attacks.Source-Routealarm_name detected. SOURCE-ROUTE attack detected oninterface interface_number.Source-Route detected. SOURCE-ROUTE attack detected oninterface 1.These alarms aretriggered by Source-Route attacks.IPSec-Floodalarm_name detected. IPSEC Floodattack detected on interfaceinterface_number.IPSec-Flood detected. IPSEC Floodattack detected on interface 1.These alarms aretriggered by high severitylevel and IPSec Floodattacks.IKE-Floodalarm_name detected. IKE Floodattack detected on interfaceinterface_number.IKE-Flood detected. IKE Floodattack detected on interface 1.These alarms aretriggered by IKE Floodattacks.DDOS-Attack-Srcalarm_name detected. Denial-of-Service attacks (>threshold) fromsource IP address/subnet maskdetected on interfaceinterface_number.DDOS-Attack-Src detected. Denialof-Serviceattacks (.50) from source192.168.226.226/255.255.255.255detected on interface 1.These alarms aretriggered by DistributedDenial of Service Sourceattacks.DDOS-Attack-Destalarm_name detected. Denial-of-Service attacks (>threshold) fordestination IP address/subnet maskdetected on interfaceinterface_number.DDOS-Attack-Src detected. Denialof-Serviceattacks (.50) fordestination 192.168.226.226/255.255.255.255 detected oninterface 1.These alarms aretriggered by DistributedDenial of ServiceDestination attacks.38 WatchGuard System Manager