The number of concurrent TCP connections from the source IP address

[Hanif]

چند روزیست همچین Alert بر روی isa server دارم
تمامی ip های سیستم های یاد شده در Alert زیر دارای ویندوز آپدیت شده و آنتی ویروس کاسپر اسکای آپدیت می باشند ، وضعیت کنسول کاسپر سبز و هیچ گونه ویروس و اتکی بر روی هیچ یک ار سیستم ها و سرور ها ندارم ، لطفا اساتید راهنمایی فرمایند
با تشکر.

Alert Information Description: The number of concurrent TCP connections from the source IP address *.*.*.* exceeded the configured limit. As a result, ISA Server will not allow the creation of new TCP connections from this source IP.
This IP address probably belongs to an attacker or an infected host.

See product documentation for more info about ISA flood resiliency.

---

موضوعات مشابه:

• network Load web page from diffrent source ip address
• پیغام received packet with own address as source address
• راهنمایی درباره Limit Number of Concurrent Connection در BWS
• اجبار Squid به استفاده از يك Interface خاص به عنوان Source address
• Description: The number of TCP connections per minute allowed from one IP address was exceeded

---

[Hanif]

اساتید کسی نیست راهنمایی کنه؟؟!!!

[ARM]

Microsoft Internet Security and Acceleration Server 2006
WV_H_FloodMitigation
To configure flood mitigation

1. In the console tree of ISA Server Management, click General.
2. In the details pane, click Configure Flood Mitigation Settings.
3. On the Flood Mitigation tab, configure the following options:
   
   • Select Mitigate flood attacks and worm propagation to enable flood mitigation. This is selected by default.
   • For each type of potential attack, click Edit to configure the mitigation settings.
   • Select Log traffic blocked by flood mitigation settings if you want to log the blocked traffic. This is selected by default.
   
   
4. On the IP Exceptions tab, click Add to add network elements to which you want to apply a custom limit.

Optimizing logging in case of attack
Each time a flood mitigation limit is exceeded, ISA Server generates an alert, indicating the IP address of the offending client. After you identify the list of offending IP addresses, to prevent unnecessary logging, perform the following procedure. This helps improve ISA Server performance during a flood.
To improve ISA Server performance during a flood

1. Disable logging either on the specific rule that matches the flood or altogether until the flood attack is stopped.
2. Reconfigure the Connections Limit alerts (or any other types of alerts that may be triggered repeatedly as a result of the specific attack) to Manually Reset.