Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently began to receive a huge (600 thousand to 2 million per day) number of FWX_E_TCP_NOT_SYN_PACKET_DROPPED, 0xc0040017 entries in my Forefront TMG logs.

If the top 3 source IPs are any indication there is no legitimate traffic to or from the IPs initiating these scans. How can I suppress these from being logged by Forefront?

Unfortunately using a standard suppression rule does not work work. I already had a suppression list in place for certain traffic, including the multicast range. This was at the top of my rule set. The rule listed is 'None - see Result Code', even for traffic being suppressed.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

It appears that the Fwengmon tool has been replaced and the netsh tmg commands do not provide a ready way to suppress these alerts. I have moved up the food chain - we collect these logs in Splunk and have Syslog-NG available as a filter. I suppressed these spurious events at the syslog-ng level by blocking the 0xc0040017 code.

share|improve this answer
add comment

Create an access rule:

Deny / All Traffic / From -> New Computer Set "Blocked Without Logging" -> add the IPs ("computers") to this list / To Anywhere / All Users / Finish.

Order it first in the list, then disable the "Log requests matching this rule" setting - on the General tab, from memory.

share|improve this answer
    
I'll try that out but I have doubts that it will work. The log entries are all listed as not having a rule applied. –  Tim Brigham Sep 7 '11 at 14:23
    
Gotcha. If it doesn't work, perhaps investigate blocking by Fwengmon. –  TristanK Sep 7 '11 at 21:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.