Ascertain ASA Threat Detection Functionality and Configuration

Introduction

This document describes threat detection functionality and configuration on Cisco Secure Firewall ASA.

---

Prerequisites

Requirements

Cisco recommends knowledge of ASA CLI, access control, and (for VPN threat detection) remote access VPN.

---

Components Used

• Classic Threat Detection (Basic, Advanced, Scanning): ASA software 8.0(2) and later. TCP Intercept statistics require 8.0(4) / 8.1(2) or later. Shun duration is configurable from 8.0(4) / 8.1(2).
• Threat Detection for VPN Services: Introduced in the 9.20 train at 9.20(3). Cisco also documents these minimums in other trains under 9.16(4)67, 9.17(1)45, 9.18(4)40, 9.19(1).37, and 9.22(1.1) (9.22(1) was not released.)

---

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

---

Background Information

Threat detection on ASA provides a Layer 3/4 front-line defense. It builds a baseline from packet-drop statistics and optional object-level “top” reports. It is not a substitute for a dedicated IPS or Next-Generation IPS module, which inspects permitted traffic up to Layer 7; the two can work together.

---

---

Threat detection provides firewall administrators tools to identify, understand, and (for scanning and VPN services) stop attacks. It relies on rate triggers, object-level statistics, and optional automatic shuns.

There are four components to this feature:

1. Basic Threat Detection (system-level drop rates) — Enabled by default
2. Advanced Threat Detection (object-level statistics and Top N) — ACL statistics enabled by default
3. Scanning Threat Detection (attacker/target database, optional shun) — Disabled by default
4. Threat Detection for VPN Services (RA VPN DoS protection, automatic shun) — Disabled by default; 9.20(3)+ / listed trains

---

Threat Detection Functionality

Basic Threat Detection (System Level Rates)

Basic threat detection is enabled by default on ASAs that run 8.0(2) and later.

---

It monitors the rates packets are dropped for various reasons by the ASA as a whole. Statistics apply to the entire appliance and are generally not granular enough to identify the source host. The ASA monitors dropped packets for these events:

• ACL Drop (acl-drop): Packets denied by access lists.
• Bad Pkts (bad-packet-drop): Invalid packet formats, including L3 and L4 headers that do not conform to RFC standards (for example, invalid-ip-header or invalid-tcp-hdr-length.)
• Conn Limit (conn-limit-drop): Packets that exceed a configured or global connection limit.
• DoS Attack (dos-drop): Denial of Service attacks (for example, invalid SPI or Stateful Firewall check failure.)
• Firewall (fw-drop): Combined rate of firewall-related drops in this list. It does not include non-firewall drops such as interface overload, inspection failures, or scanning-attack detected.
• ICMP Attack (icmp-drop): Suspicious ICMP packets.
• Inspect (inspect-drop): Denial by application inspection.
• Interface (interface-drop): Packets dropped by interface checks (overload.)
• Scanning (scanning-threat): Network/host scanning attacks (for example, first TCP packet is not SYN, or 3-way handshake failed.) Full scanning threat detection uses this rate to classify hosts and optionally shun them.
• SYN Attack (syn-attack): Incomplete session attacks, including TCP SYN attacks, and unidirectional UDP sessions that have no return data.

---

Most triggers map to specific ASP drop reasons; certain syslogs and inspection actions are also counted. Some triggers appear in more than one threat category. Common mappings (not exhaustive):

Basic Threat	Trigger(s) / ASP Drop Reason(s)
acl-drop	acl-drop
bad-packet-drop	invalid-tcp-hdr-length invalid-ip-header inspect-dns-pak-too-long inspect-dns-id-not-matched
conn-limit-drop	conn-limit
dos-drop	sp-security-failed
fw-drop	inspect-icmp-seq-num-not-matched inspect-dns-pak-too-long inspect-dns-id-not-matched sp-security-failed acl-drop
icmp-drop	inspect-icmp-seq-num-not-matched
inspect-drop	Frame drops triggered by an inspection engine
interface-drop	sp-security-failed no-route
scanning-threat	tcp-3whs-failed tcp-not-syn sp-security-failed acl-drop inspect-icmp-seq-num-not-matched inspect-dns-pak-too-long inspect-dns-id-not-matched
syn-attack	%ASA-6-302014 syslog with teardown reason of "SYN Timeout"

---

For each event, basic threat detection measures drop rates over a configured average rate interval (ARI), from 600 seconds to 30 days. If events in the ARI exceed the configured thresholds, the ASA treats them as a threat.

There are two thresholds: average rate and burst rate. Average rate is drops per second over the ARI. Burst rate use a shorter burst rate interval (BRI). Since 8.2(1), BRI is 1/30th of the ARI, or 10 seconds, whichever is higher. Before 8.2(1), BRI was 1/60th of the ARI. The 10-second minimum applies to all software versions.

Example: ACL-drop average rate 400 with ARI 600 seconds means the ASA averages ACL drops over the last 600 seconds and logs a threat if that average exceeds 400 per second. Burst rate 800 with the same ARI uses a BRI of 20 seconds (600 / 30). If ACL drops in that 20-second window exceeds 800 per second, a threat is logged.

When a basic threat is detected, the ASA generates syslog %ASA-4-733100. If both average and burst rates are exceeded, the ASA can send two 733100 messages (one per rate type), with a maximum of one message per rate type per burst period.

---

Run the show threat-detection rate command to see average, current, trigger count, and total events. The ASA stores counts at the end of each burst period for 30 completed BRIs. The unfinished current BRI is normally excluded from the average. The total event count is the sum of events in those 30 BRI samples (with a real-time exception if the unfinished BRI already exceeds the oldest sample.)

The burst rate in the syslog is calculated from drops so far in the current BRI, sampled periodically, so a breach can be reported before the BRI completes (one syslog per rate type per BRI.) The burst/current rate in show threat-detection rate uses the last completed BRI.

Basic threat detection does not drop or shun traffic. It is informational (monitoring and reporting.) Performance impact is insignificant and occurs mainly when there are drops or potential threats.

---

Advanced Threat Detection (Object Level Statistics and Top N)

Advanced threat detection tracks statistics for more granular objects: host IPs, ports, protocols, ACLs, and servers protected by TCP Intercept. Only ACL statistics are enabled by default. Host statistics have a significant performance impact under high traffic; enable them temporarily when you need them. Port statistics have a more modest impact.

---

For host, port, and protocol objects, the ASA tracks packets, bytes, and drops sent and received in fixed windows. For ACLs, it tracks the top 10 ACEs (permit and deny) hit in those windows. Permitted and denied ACE hits are not differentiated in the top-ACL display.

Fixed windows are 20 minutes, 1 hour, 8 hours, and 24 hours. The windows themselves are not configurable. The number-of-rate {1 | 2 | 3} keyword (host, port, and protocol only) controls how many of the longer intervals are kept:

• 1 (default) — only the shortest rate interval, to keep memory use low
• 2 — the two shortest intervals
• 3 — 1 hour, 8 hours, and 24 hours

---

Host statistics accumulate while the host is active in the scanning-threat host database and are cleared after 10 minutes of inactivity.

When TCP Intercept is enabled, threat detection can track the top 10 servers under attack. TCP Intercept statistics use a configurable monitoring window plus average and burst thresholds (available in 8.0(4) and later). Defaults:

• Rate interval (history window): 30 minutes (range 1–1440). The ASA samples 30 times during the window (every 60 seconds at the default.)
• Burst rate: 400 attacks/sec — syslog %ASA-4-733104
• Average rate: 200 attacks/sec — syslog %ASA-4-733105

View statistics by running the show threat-detection statistics and show threat-detection statistics top command. This is also the feature that populated the “top” graphs on the classic ASDM firewall dashboard.

Advanced threat detection is informational except that TCP Intercept already protects the server. No additional block is applied from these statistics alone.

---

Scanning Threat Detection

Scanning threat detection tracks hosts that create connections on too many hosts in a subnet, or too many ports on a host or subnet. It is disabled by default. Unlike IPS signature-based scan detection, ASA scanning threat detection maintains a host database (connections with no return activity, closed-port access, certain TCP behaviors, and more.)

---

It shares rate-interval, average rate (ARI), and burst rate (BRI) with the basic scanning-threat category. You cannot configure separate rates for basic vs scanning. The difference is scanning threat detection keeps an attacker and target IP database. Only traffic that is allowed through the ASA and creates a flow is counted. Basic threat detection can still fire a scanning-threat 733100 for ACL-denied traffic; scanning threat detection does not.

If the scanning rate is exceeded for traffic from a host, that host is an attacker. If it is exceeded for traffic to a host, that host is a target. Syslog %ASA-4-733101 is logged. You can optionally shun the attacker (%ASA-4-733102 when the shun is added, %ASA-4-733103 when it is removed.) Default shun duration is 3600 seconds (1 hour), configurable from 10 to 2592000 seconds.

Scanning threat detection with shun is one of two features that can actively drop otherwise-allowed traffic (the other is VPN threat detection).

---

Run the show threat-detection scanning-threat command for the attacker/target database and show threat-detection shun for scanning-threat shuns only.

---

---

Threat Detection for VPN Services (9.20(3)+ / listed trains)

VPN threat detection protects the ASA remote-access VPN headend from IPv4 DoS-style attacks. All three services are disabled by default. When a service is enabled and a host exceeds its threshold, the ASA automatically shuns that IPv4 address until you remove the shun.

---

Services:

• remote-access-authentication: Consecutive RA VPN login failures (password-spray / brute force). Hold-down 1–1440 minutes; threshold 1–100. SAML authentication failures are not counted.
• remote-access-client-initiations: Repeated SSL/IKEv2 connection starts that do not complete from one host. Hold-down 1–1440 minutes; threshold 5–100.
• invalid-vpn-access: Attempts to reach built-in tunnel groups that exist only for internal device operation. A matching IPv4 address is shunned immediately (hold-down/threshold effectively 1/1.)

These attacks can consume authentication and session resources even when they fail. When you set hold-down and threshold, account for PAT (hotels, CGNAT): many valid users can share one public IP. Use higher values so legitimate users can finish connecting.

VPN threat detection monitors to-the-box IPv4 only. Shuns appear in show shun, not in show threat-detection shun. Related syslogs: %ASA-6-733200 (info) and %ASA-4-733201 (threshold exceeded; shun installed.)

---

Limitations

• Classic threat detection requires ASA 8.0(2) or later. The former ASA 1000V platform did not support the feature (that platform is end of life.)
• Security Context: Except for advanced threat statistics and VPN services, threat detection is supported in single context mode only. In multiple context mode, TCP Intercept statistics are the advanced statistic that is supported. VPN threat detection is also supported in multiple mode.
• Firewall Mode: Supported in routed and transparent mode.
• For basic, advanced, and scanning statistics, only through-the-box traffic is monitored. Traffic sent to the ASA itself is not counted.
• For VPN services, only to-the-box IPv4 is monitored.
• Traffic denied by an ACL does not trigger scanning threat detection (attacker/target tracking.) Basic scanning-threat rates can increment on ACL drops.
• TCP connection attempts that are reset by the targeted server are not counted as a SYN attack or scanning threat.
• VPN authentication-failure detection does not include SAML failures.

---

Configuration

Basic Threat Detection

Basic threat detection is enabled by default, you can re-enable it with:

ciscoasa(config)# threat-detection basic-threat

---

Disable with no threat-detection basic-threat. Default rates view with show run all threat-detection:

ciscoasa(config)# show run all threat-detection
threat-detection rate dos-drop rate-interval 600 average-rate 100 burst-rate 400
threat-detection rate dos-drop rate-interval 3600 average-rate 80 burst-rate 320
threat-detection rate bad-packet-drop rate-interval 600 average-rate 100 burst-rate 400
threat-detection rate bad-packet-drop rate-interval 3600 average-rate 80 burst-rate 320
threat-detection rate acl-drop rate-interval 600 average-rate 400 burst-rate 800
threat-detection rate acl-drop rate-interval 3600 average-rate 320 burst-rate 640
threat-detection rate conn-limit-drop rate-interval 600 average-rate 100 burst-rate 400
threat-detection rate conn-limit-drop rate-interval 3600 average-rate 80 burst-rate 320
threat-detection rate icmp-drop rate-interval 600 average-rate 100 burst-rate 400
threat-detection rate icmp-drop rate-interval 3600 average-rate 80 burst-rate 320
threat-detection rate scanning-threat rate-interval 600 average-rate 5 burst-rate 10
threat-detection rate scanning-threat rate-interval 3600 average-rate 4 burst-rate 8
threat-detection rate syn-attack rate-interval 600 average-rate 100 burst-rate 200
threat-detection rate syn-attack rate-interval 3600 average-rate 80 burst-rate 160
threat-detection rate fw-drop rate-interval 600 average-rate 400 burst-rate 1600
threat-detection rate fw-drop rate-interval 3600 average-rate 320 burst-rate 1280
threat-detection rate inspect-drop rate-interval 600 average-rate 400 burst-rate 1600
threat-detection rate inspect-drop rate-interval 3600 average-rate 320 burst-rate 1280
threat-detection rate interface-drop rate-interval 600 average-rate 2000 burst-rate 8000
threat-detection rate interface-drop rate-interval 3600 average-rate 1600 burst-rate 6400

---

Tune a category by running the threat-detection rate command. Each category can have up to three rates (rate 1, 2, and 3). The rate ID that was exceeded is referenced in 733100:

ciscoasa(config)# threat-detection rate acl-drop rate-interval 1200 average-rate 250 burst-rate 550

---

In this example, 733100 is generated when the ACL drops exceed 250/sec over 1200 seconds or 550/sec over 40 seconds (1200 / 30.)

The scanning-threat keyword in this command is shared with the scanning threat detection. You can set scanning rates even if basic threat detection is disabled.

---

Advanced Threat Detection

Run the threat-detection statistics command to enable advanced statistics. With no keyword, all statistic types are enabled:

ciscoasa(config)# threat-detection statistics ?

configure mode commands/options:
  access-list      Keyword to specify access-list statistics
  host             Keyword to specify IP statistics
  port             Keyword to specify port statistics
  protocol         Keyword to specify protocol statistics
  tcp-intercept    Trace tcp intercept statistics
  <cr>

---

no threat-detection statistics (no options) removes all statistic commands, including the default threat-detection statistics access-list.

ACL statistics (default on):

ciscoasa(config)# threat-detection statistics access-list

---

Host, port, or protocol, with optional number of rate intervals:

ciscoasa(config)# threat-detection statistics host number-of-rate 2
ciscoasa(config)# threat-detection statistics port number-of-rate 2
ciscoasa(config)# threat-detection statistics protocol number-of-rate 3

---

TCP Intercept statistics (also available in multiple context mode):

ciscoasa(config)# threat-detection statistics tcp-intercept
ciscoasa(config)# threat-detection statistics tcp-intercept rate-interval 60 burst-rate 800 average-rate 600

---

Scanning Threat Detection

ciscoasa(config)# threat-detection scanning-threat
ciscoasa(config)# threat-detection rate scanning-threat rate-interval 1200 average-rate 10 burst-rate 20
ciscoasa(config)# threat-detection scanning-threat shun
ciscoasa(config)# threat-detection scanning-threat shun duration 1000
ciscoasa(config)# threat-detection scanning-threat shun except ip-address 10.1.1.1 255.255.255.255
ciscoasa(config)# threat-detection scanning-threat shun except object-group no-shun

---

You can combine shun and except on one line, and enter the command multiple times to exempt more addresses or object-groups.

ciscoasa(config)# threat-detection scanning-threat shun except ip-address 10.1.1.0 255.255.255.0

---

Threat Detection for VPN Services

ciscoasa(config)# threat-detection service invalid-vpn-access
ciscoasa(config)# threat-detection service remote-access-client-initiations hold-down 10 threshold 20
ciscoasa(config)# threat-detection service remote-access-authentication hold-down 10 threshold 20

---

Disable a service with the no form of the same command. Reset counters with clear threat-detection service.

For a dedicated walkthrough, refer to Configure Threat Detection for Remote Access VPN Services on Secure Firewall ASA (Document ID 222315.)

---

Performance

Basic threat detection has very little performance impact. Advanced host statistics and scanning threat detection are more resource intensive as they store per-host and per-object data. Enable host statistics temporarily while you troubleshoot a specific issue.

---

Features that can drop otherwise-allowed traffic:

• Scanning threat detection with shun
• VPN threat detection services (automatic shun)

Monitor memory before and after you enable advanced or scanning features:

ciscoasa# show threat-detection memory
ciscoasa# show memory app-cache threat-detection detail

---

show threat-detection memory (8.3(1)+) is the documented command for advanced-statistics memory. show memory app-cache threat-detection [detail] shows the application chunk cache.

---

Recommended Actions

When a Basic Drop Rate is Exceeded and %ASA-4-733100 is Generated

Note the threat category in 733100 and correlate with show threat-detection rate. Then check show asp drop for the drop reasons.

For a specific reason, use the ASP-drop capture:

ciscoasa# capture drop type asp-drop acl-drop

ciscoasa# show capture drop

1 packet captured

   1: 18:03:00.205189 10.10.10.10.60670 > 192.168.1.100.53:  udp 34 Drop-reason:
 (acl-drop) Flow is denied by configured rule

---

This example is a UDP/53 packet from 10.10.10.10 to 192.168.1.100.

If 733100 reports Scanning, temporarily enable scanning threat detection so the ASA can record attacker and target IPs.

Basic threat detection mostly counts traffic the ASP already dropped, so no extra drop action is required. Exceptions are SYN attacks and scanning threats that involve traffic that passes through the ASA.

If the drops are legitimate for the environment, raise the basic rate intervals. If they are attack traffic, block or rate-limit upstream (ACLs, QoS) before the ASA.

For SYN attacks, deny the source in an ACL or enable TCP Intercept to protect the target (that can produce a conn-limit threat instead). For scanning, you can deny in an ACL or enable scanning threat detection with shun.

---

When a Scanning Threat is Detected and %ASA-4-733101 is Logged

733101 lists the target host/subnet or the attacker. For the full lists, run the show threat-detection scanning-threat command.

Captures on the attacker-facing and target-facing interfaces help confirm the scan.

If the scan is unexpected, block or rate-limit upstream. Adding shun allows the ASA drop all packets from the attacker for the configured duration. As a last resort, block on the ASA with an ACL or TCP Intercept.

If it is a false positive, raise the scanning-threat rate intervals.

---

When an Attacker is Shunned and %ASA-4-733102 is Logged

733102 lists the scanning-threat shun target. Run the show threat-detection shun command for scanning-threat shuns only. Run show shun for every active shun on the ASA (scanning, VPN threat detection, and manual shun.)

---

For a real attack, also block as far upstream as possible, so intermediate devices do not process traffic. For false positives, remove the scanning shun:

ciscoasa# clear threat-detection shun
ciscoasa# clear threat-detection shun 10.1.1.6

---

When %ASA-4-733104 and/or %ASA-4-733105 is Logged

These syslogs name a host already protected by TCP Intercept. 733104 is burst rate; 733105 is average rate. Check:

ciscoasa# show threat-detection statistics top tcp-intercept
Top 10 protected servers under attack (sorted by average rate)
Monitoring window size: 30 mins    Sampling interval: 30 secs
----------------------------------------------------------------------------------
1    192.168.1.2:5000 inside 1249 9503 2249245  Last: 10.0.0.3 (0 secs ago)
2    192.168.1.3:5000 inside 10 10 6080 10.0.0.200 (0 secs ago)

---

Verify connection limits are adequate. Block the attacker upstream if possible. For a false positive, adjust the threat-detection statistics tcp-intercept rates.

---

When a VPN Host is Shunned and %ASA-4-733201 is Logged

733201 names the service and peer that exceeded the threshold. Confirm with:

ciscoasa# show threat-detection service
ciscoasa# show threat-detection service remote-access-authentication details
ciscoasa# show shun

---

IPs that have been shunned drop out of the service entries list; the blocking counter increments. If the host is legitimate (shared PAT, misconfigured client), remove the shun:

ciscoasa# no shun 192.168.100.101
ciscoasa# no shun 192.168.100.101 interface outside

---

If the address is shunned on more than one interface and you omit the interface, no shun removes the shun from one interface only (route-lookup.) Specify the interface to clear additional interfaces; clear shun removes all shuns on all interfaces.

Do not run clear threat-detection shun for VPN shuns; that command applies to scanning threat detections only.

If valid users are being shunned, raise hold-down/threshold (especially behind PAT) or disable the service until you tune it.

---

How To Manually Trigger a Threat

Use these lab methods to test and troubleshoot. Run them only in an isolated environment.

---

Basic Threat — ACL Drop, Firewall, and Scanning

ACL Drop, Firewall, and Scanning basic categories all consider acl-drop. To trigger them together:

---

1. Create an ACL on the outside interface that denies TCP to an inside target (10.11.11.11):

access-list outside_in extended line 1 deny tcp any host 10.11.11.11
access-list outside_in extended permit ip any any
access-group outside_in in interface outside

---

2. From an outside attacker (10.10.10.10), run a TCP SYN scan:

nmap -sS -T5 -p1-65535 -Pn 10.11.11.11

---

---

3. Basic threats are logged, for example:

%ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 19 per second,
 max configured rate is 10; Current average rate is 9 per second,
 max configured rate is 5; Cumulative total count is 5538
%ASA-4-733100: [ ACL drop] drop rate-1 exceeded. Current burst rate is 19 per second,
 max configured rate is 0; Current average rate is 2 per second,
 max configured rate is 0; Cumulative total count is 1472
%ASA-4-733100: [ Firewall] drop rate-1 exceeded. Current burst rate is 18 per second,
 max configured rate is 0; Current average rate is 2 per second,
 max configured rate is 0; Cumulative total count is 1483

---

---

Advanced Threat — TCP Intercept

1. Permit TCP to the inside target:

access-list outside_in extended line 1 permit tcp any host 10.11.11.11
access-group outside_in in interface outside

---

2. If the target does not exist or resets connections, blackhole with a static ARP entry:

arp inside 10.11.11.11 dead.dead.dead

---

3. Create a simple TCP Intercept (embryonic/conn limit) policy:

access-list tcp extended permit tcp any any
class-map tcp
  match access-list tcp
policy-map global_policy
  class tcp
    set connection conn-max 2
service-policy global_policy global

---

From the attacker, scan:

nmap -sS -T5 -p1-65535 -Pn 10.11.11.11

ciscoasa(config)# show threat-detection statistics top tcp-intercept
Top 10 protected servers under attack (sorted by average rate)
Monitoring window size: 30 mins    Sampling interval: 30 secs

--------------------------------------------------------------------------------
1    10.11.11.11:18589 outside 0 0 1 10.10.10.10 (36 secs ago)
2    10.11.11.11:47724 outside 0 0 1 10.10.10.10 (36 secs ago)

---

Scanning Threat

1. Permit TCP to the target (scanning threat detection only tracks allowed, created flows):

access-list outside_in extended line 1 permit tcp any host 10.11.11.11
access-group outside_in in interface outside

---

2. If needed, blackhole with static ARP. Connections reset by a real server are not counted.

arp inside 10.11.11.11 dead.dead.dead

---

3. Scan from the attacker. Lower rates or set ARI/BRI to 0 if nmap is not fast enough.

nmap -sS -T5 -p1-65535 -Pn 10.11.11.11

---

4. Expected logs when shun is enabled:

%ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 17 per second,
 max configured rate is 10; Current average rate is 0 per second,
 max configured rate is 5; Cumulative total count is 404
%ASA-4-733101: Host 10.10.10.10 is attacking. Current burst rate is 17 per second,
 max configured rate is 10; Current average rate is 0 per second,
 max configured rate is 5; Cumulative total count is 700
%ASA-4-733102: Threat-detection adds host 10.10.10.10 to shun list

---

Related Information

• Cisco Secure Firewall ASA Firewall CLI Configuration Guide, 9.20 — Threat Detection (also published for 9.23/9.24)
• Configure Threat Detection for Remote Access VPN Services on Secure Firewall ASA (Document ID 222315)
• ASA Command Reference — threat-detection commands
• ASA Command Reference — show threat-detection commands
• Cisco Secure Firewall ASA Series Syslog Messages (733100–733105, 733200–733201)
• ASA to Threat Defense Feature Mapping — Threat Detection
• Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
5.0	16-Sep-2026	Updated spelling, grammar, inserted horizontal lines to separate sections for readability, updated URLs for HTTPs, and fixed CCW alerts.
4.0	20-Jun-2023	Republish
3.0	20-Jun-2023	Updated PII, Introduction, Style Requirements, Machine Translation, Gerunds and Formatting.
1.0	31-Aug-2012	Initial Release