Cisco SCE8000

10-22
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Chapter 10 Identifying and Preventing Distributed-Denial-Of-Service Attacks
Monitoring Attack Filtering
• 'protocol'
– TCP
– UDP
– ICMP
– other
• 'rate1' and 'rate2' are numbers
• 'duration' is a number.
• 'total-flows' is one of the following strings, depending on the attack action:
– If 'action' is block: 'number' flows blocked.
– If 'action' is report: attack comprised of 'number' flows.
• 'hw-filter'
– If the attack was not filtered by a hardware filter: empty string
– If the attack was filtered by a hardware filter: HW filters used, actual attack duration is probably
smaller than reported above, actual amount of flows handled is probably larger than reported
above.
Monitoring Attack Filtering Using CLI Commands
• How to display a specified attack detector configuration, page 10-23
• How to display the default attack detector configuration, page 10-24
• How to display all attack detector configurations, page 10-25
• How to display filter state (enabled or disabled), page 10-25
• How to display configured threshold values and actions, page 10-25
• How to display the current counters, page 10-27
• How to display all currently handled attacks, page 10-27
• How to display all existing force-filter settings, page 10-27
• How to display all existing don't-filter settings, page 10-27
• How to display the list of ports selected for subscriber notification, page 10-27
• How to find out whether hardware attack filtering has been activated, page 10-28
Use these commands to monitor attack detection and filtering:
• show interface linecard 0 attack-detector
• show interface linecard 0 attack-filter
• show interface linecard 0 attack-filter query
• show interface linecard 0 attack-filter current-attacks
• show interface linecard 0 attack-filter don't-filter
• show interface linecard 0 attack-filter force-filter
• show interface linecard 0 attack-filter subscriber-notification ports