Symptoms
Two DoS vectors match the same type of traffic:
-- Device: DNS Question Items != 1
-- Protection Profile: DNS QDCOUNT LIMIT
If you have both of these DoS vectors configured, only the "DNS Question Items != 1" DoS vector is matched.
Impact
Only the "DNS Question Items != 1" alert is raised.
Both of these DoS vectors have identical meanings internally, and so only "DNS Question Items != 1" will be triggered.
Conditions
-- Both "DNS QDCOUNT LIMIT" and "DNS Question Items != 1" are configured.
-- The DOS vectors are triggered
