Drop Rate Exceeded

I just upgrade our MARS to 6.03 and and I am getting this message from our ASA. I was simply going to place in a drop rule, but there is no IP address to use for the rule. The IP address are all NA.
Drop Rate Exceeded N/A 0 N/A N/A N/A
Can I create a rule to drp this alert?

After you upgrade MARS from version 6.0.2 to 6.0.3, it appears that drop rules are ignored.
Update your MARS with the patch release 6.0.3 (3188) (csmars-6.0.3.3190-customerpatch.zip) in order to correct the potential issues with drop rules.
http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/rules.html#wp532001
The specified object in the system log message has exceeded the specified burst threshold rate or average threshold rate. The object can be drop activity of a host, TCP/UDP port, IP protocol, or various drops due to potential attacks. It indicates the system is under potential attack.

Similar Messages

Error during PO creation "Total BED % rate exceeds 100 % "

Hi.
Its concerned to Indian Excice.
Error during the creation of PO is " Total BED % rate exceeds 100 % " ,
( Message no. 8I453).
And you pls note in J1ID its 16% maintained for that perticular chapter id and its 100% for BED in tax code.
Can you pls tell me the reason for this error.
Regds

Hi Santosh,
362 is not maintained for BASB,but its maintained for condition type JMO1(IN:A/P BED Deductable) & JMO2(IN: A/P BED non deduct )in <b>AltCTy</b> field.
And For BASB 605 is maintained in the field AltCBV.
Can you Pls explain the significance of this alternative calculation type.
Regds

FEX 6800-IA interface high drop rate and high overrun counters combined with slow throughput.

The interface drop rate count arises and the traffic throughput gets down to 15% of the nominal data rate of the 1Gb interface when a server with a 10Gb interface send data to a client connected at 1Gb FEX interface.
How must I configure the interface to achieve nearly 100% of 1Gb?
Client to Server: 100% of 1Gb; Sever to Client 15% of 1Gb
Server ---(10Gb)--- Nexus7010-- (10Gb)--- C6880-X----(10Gb)---FEX----(1Gb)Client

Sorry, yes of course:
Server ---(10Gb)--- Nexus7010-- (10Gb)--- C6880-X----(10Gb)---6800-IA----(1Gb)---Client

Scan rate exceed the limit?

the program runs good when we use 600000hz as scan rate,but it gives error when we use 700000 hz as scan rate, saying that the scan rate exceed the hardware limit. but the manual of the hardware(DAQ board), gives 1250000 hz as the upper limit of scan rate.what is the possible true reason for this error?

When entering the scan rate, you have to take into account how many channels you are scanning to determine the sampling rate. For instance, when scanning 3 channels at 700000 Hz, you are scanning through all 3 channels at 700000 Hz and so you're trying to make the board sample at 700000*3 Hz (2100000 Hz). This exceeds the limit of the hardware.
Even at 600000 Hz (sample rate of 600000*3 = 1800000 Hz) you are above the maximum sampling rate. 1250000 is specified maximum sampling rate but sometimes you can acquire above the maximum rate. I hope this helps.
Regards,
Todd D.
Applications Engineer
National Instruments

CYP2EUR fix rate exceed 5 decimal place/RATIO change?

Exchange rate for EUR:CYP (fix rate) is 0,585274 which exceed the SAP allowance 5 decimal place.
Can you advice what should be done in the system to enter the exchange rate above? Should we change to ratio (TCURF) from 1:1 to 10:1 or 100:1? Is there any impact if the ratio is changed?
Note: We are using SAP4.0B.

Hi
This can be done through T.Code - OY04.
Caution:- This configuration step has Cross- Client effects. So be careful.
Cheers
V.Krishnan
(Assign Points if Useful)

[CS2, CS3] Drop shadow exceeds picture frame

Hi there,
maybe this is a well known effect, if not for myself ...
If you apply a drop shadow to a placed image that has a clipping mask active, you may end up with a shadow area that falls inside the images picture frame as well as outside of it.
This is OK up to a certain point but what if I have to crop the image on one side or the other? The shadow may exceed the picture frame now where I actually want it to be cut. [Hopefully I am making myself sufficiently clear ...]
So is there some option connected to the drop shadow feature to restrict the shadow to the
inside of the picture frame?
Thanks
Klaus

I have experienced similar issues both with clipping paths and with drop shadows. I teach a class for Indesign and an image in one particular exercise I use has a clipping path around a head+shoulders shot of a woman. The path is a P'shop path created from an alpha channel.
In InDesign the image is on top of a tint background which is on a separate layer. The clipping path is not clipping the full image but is leaving a fine, white, unclipped border around the image area (may be only a single row/column of pixels all the way around). As the clipped image has a drop shadow applied in exactly the way David describes, the drop shadow is also applied to these "unclipped" pixels around the edges.
I confess that, as this is just an exercise and has never gone to print, I had not noticed this. One of my students did notice it because he had experienced the same problem in preparing a print job and it had cost his company a fair amount of money to correct it.
John

Syslog Message

Hi all,
In my firewall ASA 5540,Every day I am getting the syslog message.
4
Jul 07 2014
08:57:39
[ Scanning] drop rate-2 exceeded. Current burst rate is 0 per second, max configured rate is 8; Current average rate is 7 per second, max configured rate is 4; Cumulative total count is 28683
Please explain about above mentioned syslog.

Hi Kabeer,
That is because of the threat detection value set on your ASA. This might be an attack.
Because of the scanning rate configured and the
threat-detection rate scanning-rate 3600
average-rate 15
command:
%ASA-4-733100: [144.60.88.2] drop rate-2 exceeded. Current burst rate is 0 per
second, max configured rate is 8; Current average rate is 5 per second, max
configured rate is 4; Cumulative total count is 38086
Recommended Action
Perform the following steps
according to the specified
object type that appears
in the message:
1.
If the object in the message is one of the following:
Firewall
Bad pkts
Rate limit
DoS attck
ACL drop
Conn limit
ICMP attck
Scanning
SYN attck
Inspect
Interface
Check whether the drop rate is ac
ceptable for the running environment.
2.
Adjust the threshold rate of the particular drop to an appropriate value by using the
threat-detection rate
xxx command, where
xxx
is one of the following:
acl-drop
bad-packet-drop
conn-limit-drop
dos-drop
fw-drop
icmp-drop
inspect-drop
interface-drop
scanning-threat
syn-attack
3.
If the object in the message is a TCP or UDP port
, an IP address, or a
host drop, check whether
or not the drop rate is accepta
ble for the running environment.
4.
Adjust the threshold rate of the particular drop to an appropriate value by using the
threat-detection rate bad-packet-drop
command.
Note
If you do not want the drop rate exceed warning to appear, you can disable it by using
the
no threat-detection basic-threat command.
You can refer the below mentioned cisco document for more information.
http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs.pdf
Regards
Karthik

Why do I receive "4.3.2 connection rate limit exceeded" error message using the mail merge extension and what can be done about it?

I am using TB 31.3.0 with Mail Merge 3.9.1. I routinely send an email to 435 members of an volunteer emergency responders group that I coordinate. I do so using a .csv list with mail merge. While there were no problems in the past, more recently the mail merge function will hang after sending a varied number of messages successfully and I get the following error message:
"An error occurred sending mail. The mail server sent an incorrect greeting: 4.3.2 connection rate exceeded.."
There is an "OK" button in the error message pop up that can be clicked to resume the mail merge process. It would appear that if I click the "OK" button immediately whenever the error message is received I must do so frequently and some members do not receive their email. If I delay clicking the "OK" button, I found that I only needed to click the "OK" button twice to send to all the members.
An on line search suggests this is the result of some sort of throttling by my ISP, Sonic.net. There is also this comment: "If you are receiving this error, you are likely using mailing list software which cannot decipher the temporary fail codes. If so, you will need to set your software to slow down its delivery rate and/or reduce the number of active connections per remote host."
I am not super technical. Is it realistic to think that I can tweak mail merge to that I do not have to babysit my email to this group?

then I suggest you send using a mail provider that is not actively trying to block your outgoing mail. Or use a yahoo / google groups mailing list feature so you only send a single mail.
Or use a free account from the likes of http://www.ymlp.com/ who limit free account mailing lists to 1000 subscribers. ( Googled them this morning)

Bandwidth Rate-Limit -w- WWR-Queue

How would one convert a layer-2 port's "switchport rate-limit" bandwidth statement, on a 6509 -w- WS-X6748-SFP ports, to a routed/layer-3 "wrr-queue" bandwidth statement policy? Basically trying to hard-core the port's speed to 20MB. Current/tested layer-2 port bandwidth setting:
rate-limit input 20000000 5000 5000 conform-action transmit exceed-action drop
rate-limit output 20000000 5000 5000 conform-action transmit exceed-action drop
Got lost in how to use/configure all WRR's four queues... just need to limit the port's bandwidth to 20MB. Any suggestions would be appreciated.
Thanks, Kevin

1) Enabled QoS globally...
2960(config)#mls qos
2) Configure an ACL to define the matched traffic...
2960(config)#access-list 111 permit ip any any
3) Configure a class map for the matched traffic...
2960(config)#class-map traffic
2960(config-cmap)#match access 111
4) Configure a policy-map to define action...
2960(config)#policy-map Control
2960(config-pmap)#class traffic
2960(config-pmap-c)#police 10000000 8000 exceed-action drop
5) Attached the policy-map to the interface.
a) Example
-In this case, I'll attach the policy map to port_1....
2960(config)#int fa0/1
2960(config-if)#service-policy input Control
>>>>>> This will rate-limit traffic coming from the PC

Total drops for class-map class-default

Hi,
I have a gigabit ethernet interface on a 2951 configured with 4x sub interfaces providing connectivity to our four WAN sites. Each sub interface services a 100mb connection to another site.
I have configured a QoS policy and attached to each sub interface with the primary function of limiting each sub interface to 100mbs. I am now seeing drops (total drops) on the class default and not sure why. I would not expect to see any drops on this interface as it never even reaches 15mb (15%) capacity.
Any ideas?
        Class-map: class-default (match-any)
          175934881 packets, 95319007968 bytes
          5 minute offered rate 23000 bps, drop rate 0000 bps
          Match: any
          queue limit 64 packets
          (queue depth/total drops/no-buffer drops) 0/340/0
          (pkts output/bytes output) 314212026/180287074028
policy-map PM-Branch-QoS
class CM-OAM
set dscp af11
class CM-Network
set dscp cs6
class CM-VC
bandwidth percent 5
class CM-Citrix
set dscp af21
class CM-CAPWAP
set dscp af22
policy-map PM-WAN
class class-default
shape peak 100000000
   service-policy PM-Branch-QoS

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
I would not expect to see any drops on this interface as it never even reaches 15mb (15%) capacity.
Your expectations might be incorrect. Often percentage of bandwidth capacity measurements are misunderstood.
Let's assume your ingress is 100 Mbps. Let's also assume your measuring over a five minute period. Lastly, assume the ingress transmits at 100% for 1 minute and then stops for 4 minutes. Bandwidth utilization across the 1 minute would be 100% and 0% for the other 4 minutes, but it would be 20% for the 5 minutes.
But if the 100 Mbps was sent at 100% for each 12 seconds, and not sent for each 48 seconds, 5 minute utilization would still be 20% but unlike the prior 1 minute stats of 100% and 0%, each minute would now also be 20%.
So these first two examples show how bandwidth utilization don't reveal what's happening within the measured time period.
Since ingress was same bandwidth as egress, in the above, there would be no queuing.
If ingress is gig, though, suppose gig ingress arrives for 6 seconds and stops for a remaining 4 minutes and 54 seconds. This too would measure as 20% usage across 5 minutes, but since it will take 60 seconds to transmit the same traffic at 100 Mbps, packets will need to be queued. If queuing buffers are insufficient to hold all the packets, some will be dropped.
The above is a long way of saying, if your ingress rate exceeds your egress rate, there can be a need to queue packets, and if queuing is insufficient, packets will be dropped, this even if utilization is "low". Most likely, you have occasional "bursts" if ingress bandwidth exceeds the egress bandwidth.
From your actual stats, the drop rate percentage is so low, you might not need to concern yourself with the few drops you're seeing. If it is a concern, you might be able to reduce the drop rate by increasing egress buffering, but doing so, also increases egress queuing delay.

7609 RSP vlan based internet bandwidth rate limit

Hi,
I have a requirements to restrict the bandwidth for CORP internet users in our metro network, Could you check this template is good to go for to restrict the download and upload speed in Users WAN interface which is VLAN, my bandwidth limitations is 5 Mbps downlink and 5 Mbps uplink.
class-map match-all corp_traffic1
match access-group name corp_traffic
policy-map CORP_ingress
class corp_traffic1
    police 5000000 500000 conform-action transmit exceed-action drop
ip access-list extended corp_traffic
permit ip 172.25.5.0 0.0.0.255 any
permit ip any 172.25.5.0 0.0.0.255
Interface vl 351
service-policy input CORP_ingress
service-policy output CORP_ingress
Thanks&Regards
-Saji

Riccardo,
Thank you for your response..
I have RSP as SUP and ES20 as uplink card..
but I have clarfication...Is service policy input is realy required...
It seems input position is not working from this below logs..It is not matching the same
ABR#sh policy-map interface vlan 3xx
Service-policy input: CORP_ingress
    class-map: corp_traffic1 (match-all)
      Match: access-group name corp_traffic
      police :
        5000000 bps 156000 limit 156000 extended limit
      Earl in slot 1 :
        0 bytes
        5 minute offered rate 0 bps
        aggregate-forwarded 0 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 0 bps exceed 0 bps
      Earl in slot 2 :
        0 bytes
        5 minute offered rate 0 bps
        aggregate-forwarded 0 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 0 bps exceed 0 bps
      Earl in slot 3 :
        0 bytes
        5 minute offered rate 0 bps
        aggregate-forwarded 0 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 0 bps exceed 0 bps
      Earl in slot 5 :
        0 bytes
        5 minute offered rate 0 bps
        aggregate-forwarded 0 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 0 bps exceed 0 bps
    Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: any
        0 packets, 0 bytes
        5 minute rate 0 bps
Service-policy output: CORP_ingress
    class-map: corp_traffic1 (match-all)
      Match: access-group name corp_traffic
      police :
        5000000 bps 156000 limit 156000 extended limit
      Earl in slot 1 :
        3739884 bytes
        5 minute offered rate 20576 bps
        aggregate-forwarded 3739884 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 17464 bps exceed 0 bps
      Earl in slot 2 :
        0 bytes
        5 minute offered rate 0 bps
        aggregate-forwarded 0 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 0 bps exceed 0 bps
      Earl in slot 3 :
        105048931 bytes
        5 minute offered rate 539032 bps
        aggregate-forwarded 105048931 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 545760 bps exceed 0 bps
      Earl in slot 5 :
        0 bytes
        5 minute offered rate 0 bps
        aggregate-forwarded 0 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 0 bps exceed 0 bps
I will post more update on this...as I am waiting for the clients to test the same..

Service-Policy Or Bandwidth Rate Limit for IP

Hii Netpros,
Is this possible to configure the Service Policy(for Bandwidth) or Bandwidth Rate Limit for Single IP. For eg: If we want to configure the Service Policy(for Bandwidth) or Bandwidth Rate Limit of 2Mb for only IP " 10.10.10.3" on network i.e the Host or device which is configured with this IP can access upto 2Mb only.
Actual Network :-   We need this to configure this for wireless customers, Actually we have created one Vlan 2 (IP:- 10.10.10.1/29 @ our end router) , 10.10.10.2 on Basestation wiresss device (Vlan 2 allowed on this wireless device) and this wireless device is working as point to multipoint wireless. i.e 2 or more then 2 wireless customers or last mile will connect to this basestation wireless. Wireless customer-1 is 10.10.10.3 (2Mb bandwidth) and Wireless Customer-2 10.10.10.4 (512Kb).
Hence we require to limit the bandwidth for this 2 wireless customers having different bandwidth. how to acheive & control bandwidth @ our end router for them. please suggest.
Thanks

This topic is probably better suited in another Infrastructure forum, but I suppose it depends on which features are supported by your Cisco hardware and software. This doc discusses a variety of options:
http://www.cisco.com/en/US/docs/ios/12_2/qos/configuration/guide/qcfpolsh.html
For example, with the older CAR (committed access rate) approach:
interface FastEthernet5/0
     rate-limit input access-group 101 20000000 [normal burst size] [excess burst size] conform-action transmit exceed-action drop
     rate-limit input access-group 102 5120000 [normal burst size] [excess burst size] conform-action transmit exceed-action drop
access-list 101 permit ip 10.10.10.3 0.0.0.0
access-list 102 permit ip 10.10.10.4 0.0.0.0
You can observe CAR in action with "show interfaces fa5/0 rate-limit" for example.

Rate-limit command interpretation

I am not sure this is in the right area or not but I hope it is. I have the following rate-limit command on my cisco 7206 router Gi subinterface:
rate-limit input 30000000 5625000 11250000 conform-action transmit exceed-action drop
rate-limit output 30000000 5625000 11250000 conform-action transmit exceed-action drop
Does this mean I am rate-limiting this interface at 3Mb or 30 Mb?
Thank you

I am not sure this is in the
right area or not but I hope it is. I have the following rate-limit
command on my cisco 7206 router Gi subinterface: rate-limit input 30000000 5625000 11250000 conform-action transmit exceed-action drop
rate-limit output 30000000 5625000 11250000 conform-action transmit exceed-action dropDoes this mean I am rate-limiting this interface at 3Mb or 30 Mb?Thank you
This will presumably limit the interface to 30 Mbits/sec
Hope to Help !!
Ganesh.H
Remember to rate the helpful post

RATE limit RATE limit RATE limit RATE limit

Dear,
I have tried using RADIUS server to apply rate-limit to my ADSL coustomers using :
rate-limit output access-group 101 1024000 6000 512000 conform-action transmit exceed-action drop
i applied this at raduis server at my output interface but i does not work.
there is no output for sh interface rate limit.
the configuration and settings for rate limit are applied at raduis server....ok
when i do sh interface rate limit on router....i dont have any results.
i have configured (VPDN interface-Virtual and interface-access ) for my ADSL coustomers.
i need to make bills for this customrs.
please if the points not clear let me know

Try this configuration in your interface , or write the access list depend upon your requirement and implement it.
access-list 152 permit tcp any host eq www
access-list 153 permit tcp any host eq www established
interface {int}
rate-limit output access-group 153 1024000 6000 512000
conform-action transmit exceed-action drop
rate-limit output access-group 152 1024000 6000 512000
conform-action transmit exceed-action drop
finally verifies this configuration through the following commands.
show access-lists rate-limit
Displays information about rate-limit access lists.
show interfaces rate-limit
Displays information about CAR for a specified interface

3750 me rate-limit vlan

Hello!
On my 3750me i do next configuration:
int vlan 999
ip address 10.0.0.1 255.255.255.252
rate-limit input 100000 8000 8000 conform-action transmit exceed-action drop
rate-limit output 100000 8000 8000 conform-action transmit exceed-action drop
Nothing happens. Please help rate-limit vlan. How can i do it?

Hello,
don't know if you are still interested in this anyway I have 3 suggestions:
1. Check if mls qos is enabled (sh mls qos)
2. use MQC policer instead of old CAR
3. check the stats using sh mls qos interface x/x/x/ stat
regards,
Riccardo

Drop Rate Exceeded

Similar Messages

Maybe you are looking for