Cisco SCE8000 Configuration Guide

10-10
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Chapter 10 Identifying and Preventing Distributed-Denial-Of-Service Attacks
Configuring Attack Detectors
How to Disable Specific-IP Detection for Protocols Other than TCP, UDP, and ICMP for all Attack
Directions
Step 1 From the SCE(config if)# prompt, type no attack-filter protocol other and press Enter.
How to Disable Specific-IP Detection for ICMP for Single-sided Attacks Defined by the Source IP
Step 1 From the SCE(config if)# prompt, type no attack-filter protocol ICMP attack-direction
single-side-source
and press Enter.
Configuring the Default Attack Detector
• Options, page 10-10
• How to Define the Default Action and Optionally the Default Thresholds, page 10-11
• How to Reinstate the System Defaults for a Selected Set of Attack Types, page 10-12
• How to Reinstate the System Defaults for All Attack Types, page 10-12
Use these commands to configure the values for the default attack detector for the following parameters:
• Attack handling action
• Thresholds
• Subscriber notification
• Sending an SNMP trap
If a specific attack detector is defined for a particular attack type, it will override the configured default
attack detector.
Options
The following options are available:
• attack-detector — The attack detector being configured; in this case, the default attack detector.
• protocol — Defines the protocol to which the default attack detector applies.
• attack-direction — Defines whether the default attack detector applies to single sided or dual sided
attacks.
• destination port {TCP and UDP protocols only) — Defines whether the default attack detector
applies to port-based or port-less detections.
• side — Defines whether the default attack detector applies to attacks originating at the subscriber
or network side.
• action — Default action:
– report (default) — Report beginning and end of the attack by writing to the attack-log.
– block — Block all further flows that are part of this attack, the SCE platform drops the packets.

Cisco SCE8000 Specifications

General

Brand	Cisco
Model	SCE8000
Category	Network Hardware
Language	English