Description

This article provides information about the TCP/UDP sweep configuration.

Symptoms

Configuration:

set security screen ids-option sweep tcp tcp-sweep threshold 1000

What does the threshold actually mean?
root# set security screen ids-option sweep tcp tcp-sweep ?
Possible completions:
<[Enter]> Execute this command
threshold Threshold which specifies the minimum time per TCP packets
| Pipe through a command

}

Solution

 

 For example, take the threshold of 10,000:

Interval = 10,000us = 0.01s

The screen calculation would be for 10 packets. So, 10 packets at an interval of 0.01s, between each packet would equate to the following:

Consequently, the lowest pps before the screen, which would be triggered is:

10packets/10*0.01s = 100pps

The following table lists the various settings and calculation:

Threshold Time Lowest Stream (pps)
 1000,000  1 sec  1 pps
 100,000  0.1 sec  10 pps
 10,000  0.01 sec  100 pps
 1,000  0.001sec  1000 pps