D-Link xStack DES-3200 Series - Page 383

xStack® DES-3200 Series Layer 2 Ethernet Managed Switch CLI Reference Manual
37
8
config dos_prevention dos_type
This
command is used to discard the L3 control packets sent to CPU
from specific ports.
Purpose
config d
os_prevention dos_type [ {land_attack | blat_attack |
smurf_attack | tcp_null_scan | tcp_xmascan | tcp_synfin |
tcp_syn_srcport_less_1024} (1) | all] {action [ drop | mirror <port> {priority
<value 0-7> | rx_rate [ no_limit | <value 64-1024000> ] } ] | enable |
disable ] } (1)
Syntax
This
command is used to configure the prevention of DoS attacks, and
includes state and action. The packets matching will be used by the
hardware. For a specific type of attack, the content of the packet,
regardless of the receipt port or destination port, will be matched against
a specific pattern.
Description
The type of DoS attack. Po
ssible values are as follows:
Parameters
land_attack
blat_attack
smurf_attack
tcp_null_scan
tcp_xmascan
tcp_synfin
tcp_syn_srcport_less_1024
state - Enable or disable DoS prevention.
By default, prevention for all types of DoS are enabled except for
tcp_syn_srcport_less_1024.
action - When enabling DoS prevention, the following actions can be
taken.
drop – Drop the attack packets.
mirror – Mirror the packet to other port for further process.
priority – Change packet priority by the Switch from 0 to 7.
If the priority is not specified, the original priority will be used.
rx_rate – controls the rate of the received DoS attack packets.
If not specified, the default action is drop.
Only Administrator-level users
can issue this command.
Restrictions
Example usage
To configure a land attack and blat attack prevention:
DES-3200-28:4# config dos
_
prevention dos
_
type land
_
attack blat
_
attack state
enable action drop
Command: config dos
_
prevention dos
_
type land
_
attack blat
_
attack state enable
action drop
Success.
DES-3200-28:4#