Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSuspicious activity365BGP Invalid COMMUNITIES LengthBase Event:Details:ReferencesBGP_UPDATE_COMMUNITIES_BAD_LENGTHThe BGP OPEN message capability field had a field length disallowed by the RFC. This violation ofthe standard could indicate an attempt to compromise the protocol.BGP SpecificationsBGP Invalid Hold TimeBase Event:Details:ReferencesBGP_INVALID_HOLD_TIMEThe BGP OPEN message advertised a hold time that falls outside the allowed range of values. Thisviolation of the standard could indicate an attempt to compromise the protocol.BGP SpecificationsBGP Invalid LOCAL_PREF LengthBase Event:Details:ReferencesBGP_UPDATE_LOCAL_PREF_BAD_LENGTHThe BGP UPDATE message contained an invalid ATOMIC_AGGREGATE length. This violation ofthe standard could indicate an attempt to compromise the protocol.BGP SpecificationsBGP Invalid KEEPALIVE Message LengthBase Event:Details:ReferencesBGP_BAD_KEEPALIVE_MSG_LENGTHThe BGP KEEPALIVE message length was outside the limitations specified in the RFC. Thisviolation of the standard could indicate an attempt to compromise the protocol.BGP SpecificationsBGP Invalid MarkerBase Event:Details:ReferencesBGP_BAD_MARKERThe BGP OPEN message marker has to consist of all 1s (0xFF), but a different marker was sent. Thisviolation of the standard could indicate an attempt to compromise the protocol.BGP SpecificationsBGP Invalid MarkerBase Event:Details:ReferencesBGP_OPEN_CAPABILITY_LENGTH_MISMATCHThe BGP OPEN message capability length was invalid. This violation of the standard could indicatean attempt to compromise the protocol.BGP SpecificationsBGP Invalid Message LengthBase Event:Details:ReferencesBGP_BAD_MSG_LENGTHThe BGP message length was outside the limitations specified in the RFC. This violation of thestandard could indicate an attempt to compromise the protocol.BGP Specifications