Symantec™ Security Gateways Reference Guide - Sawmill

364 IDS eventsSuspicious activitySuspicious activityBGP Authentication FailureBase Event:Details:ReferencesBGP_AUTH_FAILUREA BGP authentication failure was detected. This is an indication that an attack is being launched onthe network routers.BGP SpecificationsBGP Generic ErrorBase Event:Details:ReferencesBGP_GENERIC_ERROR_CONDITIONA BGP NOTIFICATION message, indicating a protocol error condition, was detected. This is anindication that an attack is being launched on the network routers.BGP SpecificationsBGP Invalid AGGREGATOR LengthBase Event:Details:ReferencesBGP_UPDATE_AGGREGATOR_BAD_LENGTHThe BGP UPDATE message contained an invalid AGGREGATOR length. This violation of thestandard could indicate an attempt to compromise the protocol.BGP SpecificationsBGP Invalid ASPATH LengthBase Event:Details:ReferencesBGP_UPDATE_ASPATH_BAD_LENGTHThe BGP UPDATE message contained an invalid ASPATH length. This violation of the standardcould indicate an attempt to compromise the protocol.BGP SpecificationsBGP Invalid Attribute FlagsBase Event:Details:ReferencesBGP_BAD_ATTRIBUTE_FLAGSThe lower four bits of the attribute flags field in a BGP UPDATE message must be set to zero, butwere not. This violation of the standard could indicate an attempt to compromise the protocol.BGP SpecificationsBGP Invalid Capability LengthBase Event:Details:ReferencesBGP_OPEN_INVALID_CAPABILITY_LENGTHThe BGP OPEN message capability field had a field length disallowed by the RFC. This violation ofthe standard could indicate an attempt to compromise the protocol.BGP Specifications