SummaryCollectord is using a significant amount RAM due to DDoS attempts on Exinda, resulting in a crash from the huge RAM spike
OverviewDue to too many new connections per second, the RAM is spiking up in utilization so fast that the appliance is rebooting.
CauseThe Exinda appliance will try to record statistics about connections passing through the device. Even if there are ultimately ignored, aborted, or refused, a certain amount of RAM will be allocated to track the connections. If there are millions of short-lived connections, then the appliance will still try to record stats for them.
WorkaroundIn ExOS 7.4.2, a feature was added to prevent the collection of statistics for ignored connections. Since the majority of DDoS traffic will be ignored, this should greatly help reduce amount of RAM that will be consumed during such attacks. In ExOS 7.4.3 and higher, this feature is not enabled by default, but can be enabled using the following CLI commands:
ddos tcp ignore