Cisco SCE2020-4XGBE-SM - How to Display a Specified Attack Detector Configuration

11-24
Cisco SCE 2000 and SCE 1000 Software Configuration Guide
OL-7827-12
Chapter 11 Identifying and Preventing Distributed-Denial-Of-Service Attacks
Monitoring Attack Filtering
How to display a specified attack detector configuration
• Options, page 11-24
• Example, page 11-24
The following information is displayed:
• Protocol Side — Whether the attack detector applies to attacks originating at the subscriber or
network side.
• Direction — Whether the attack detector applies to single sided or dual sided attacks. Action to take
if an attack is detected.
• Thresholds:
– open-flows-rate — Default threshold for rate of open flows (new open flows per second).
– suspected-flows-rate — Default threshold for rate of suspected DDoS flows (new suspected
flows per second).
– suspected-flows-ratio — Default threshold for ratio of suspected flow rate to open flow rate.
• Subscriber notification — enabled or disabled.
• Alarm: sending an SNMP trap enabled or disabled.
Options
The following option is available:
• number — the number of the attack detector to display
Step 1 From the SCE> prompt, type show interface linecard 0 attack-detector number and press Enter.
Example
SCE>show interface LineCard 0 attack-detector 1
Detector #1:
Comment: 'Sample'
Access-list: 1
Effective only for TCP port(s) 21,23,80
Effective for all UDP ports
Protocol|Side|Direction ||Action| Thresholds |Sub- |Alarm
| | || |Open flows|Ddos-Suspected flows|notif|
| | || |rate |rate |ratio | |
--------|----|-----------||------|----------|------------|-------|-----|-----
TCP |net.|source-only|| | | | | |
TCP |net.|dest-only || | | | | |
TCP |sub.|source-only|| | | | | |
TCP |sub.|dest-only || | | | | |
TCP |net.|source+dest|| | | | | |
TCP |sub.|source+dest|| | | | | |
TCP+port|net.|source-only||Block | | | | |Yes
TCP+port|net.|dest-only || | | | | |
TCP+port|sub.|source-only||Block | | | | |Yes
TCP+port|sub.|dest-only || | | | | |
TCP+port|net.|source+dest|| | | | | |
TCP+port|sub.|source+dest|| | | | | |
UDP |net.|source-only|| | | | | |
UDP |net.|dest-only || | | | | |
UDP |sub.|source-only|| | | | | |
UDP |sub.|dest-only || | | | | |