HP 3400CL-24G manual Release M.10.04 Enhancements, Instrumentation Monitor

Enhancements

Release M.10.04 Enhancements

ProCurve# show sflow sampling-polling 1-5

sflow destination Enabled

Port	Sampling	Rate	Header	Dropped	Polling	Interval
----- +	Enabled			Samples	Enabled
	-------	--------	------	---------- +	------- --------
1	Yes	6500000	128	5671234	Yes	60
2	No	50	128	0	Yes	300
3	Yes	2000	100	24978	No	30
4	Yes	200	100	4294967200	Yes	40
5	Yes	20000	128	34	Yes	500

Figure 15. Example of Viewing sFlow Sampling and Polling Information

The show sflow all command combines the outputs of the preceding three show commands including sFlow status information for all the ports on the switch.

Release M.10.04 Enhancements

Release M.10.04 includes the following enhancements:

■Enhancement (PR_1000330743) - Instrumentation Monitor, which includes Denial of Service (DoS) logging enhancement.

■Enhancement (PR_1000331027) - TCP/UDP port closure enhancement.

■Enhancement (PR_1000330532) - Improved the "show" command display of STP port detail information to assist in monitoring and troubleshooting of the spanning tree protocol.

Instrumentation Monitor

The 3400cl switches have instrumentation to monitor many operating parameters at pre-determined intervals. Beginning with software release M.10.04, this capability can be used to detect anomalies caused by security attacks or other irregular operations on the switch. The following table shows the parameters that can be monitored, and the possible security attacks that may trigger an alert:

Parameter Name	Description
pkts-to-closed-ports	The count of packets per minute sent to closed TCP/UDP ports. An excessive amount
	of packets could indicate a port scan, in which an attacker is attempting to expose a
	vulnerability in the switch.
arp-requests	The count of ARP requests processed per minute. A large amount of ARP request
	packets could indicate an host infected with a virus that is trying to spead itself.

70