DDoS? Lots of dropped ssl connections

[vcl_]

Hi there,

Only at the beginning of investigations but we encountered a crash of a MAG6611 cluster (SM360).

The first thing I can see in logs are a lot o connections, from different publics IP, dropped in Events logs with reason :"wrong signature type" as an SSL event.

This seems to happens at the very beginning of the session.

I have two feelings:

- IVE soft crashed and lots of users were so rejected with this error log

- Kind of a DDoS with lots of SSL half-open sessions, who led to the IVE problem

If anyone here encountered this kind of logs already, I'll be glad to read.

Regards,

[vcl_ · Accepted solution]

Self reply if that can help someone in the future:

It was due to web process overload, nothing to do with DDoS.