DHCP_1.3.6.1.4.1.2011.5.25.112.2.6 hwDhcpPktRateAlarm

Description

DHCP/1/RATETRAP:OID [OID] The rate of DHCP packets exceeds the speed limit. (IfIndex=[INTEGER], VlanIndex=[INTEGER], Interface=[OCTET], VlanID=[INTEGER], DiscardedNumber=[INTEGER]).

The number of discarded DHCP packets reached the threshold after the DHCP message rate exceeded the upper limit.

Attribute

Alarm ID	Alarm Severity	Alarm Type
1.3.6.1.4.1.2011.5.25.112.2.6	Critical	equipmentAlarm(5)

Parameters

Name	Meaning
OID	Indicates the MIB object ID of the alarm.
IfIndex	Indicates the interface index.
VlanIndex	Indicates the VLAN index.
Interface	Indicates the interface name.
VlanID	Indicates the VLAN ID.
DiscardedNumber	Indicates the number of discarded packets.

Impact on the System

The DHCP packets of which the rate exceeds the upper limit are discarded.

Possible Causes

A large number of DHCP packets were received.

Procedure

Configure port mirroring to obtain DHCP packets received by the interface. Check whether DHCP packets are attack packets.
- If a user connected to the interface sends a large number of DHCP packets, the DHCP packets are attack packets. The device discards the attack packets. Check the attack source based on the source address.
- If users connected to the interface do not send a large number of DHCP packets, the DHCP packets are not attack packets. Determine whether to run the dhcp snooping check dhcp-rate rate or dhcp snooping check dhcpv6-rate rate command to adjust the upper rate limit of DHCPv4 or DHCPv6 packets or run the dhcp snooping alarm dhcp-rate threshold threshold or dhcp snooping alarm dhcpv6-rate threshold threshold command to adjust the alarm threshold of discarded DHCPv4 or DHCPv6 packets according to the actual situation and user requirements.

Related Information

None