Chapter 9
| General Security Measures
Denial of Service Protection
– 314 –
Example
Console#show ip arp inspection vlan 1
VLAN ID DAI Status ACL Name ACL Status
-------- --------------- -------------------- --------------------
1 disabled sales static
Console#
Denial of Service Protection
A denial-of-service attack (DoS attack) is an attempt to block the services provided
by a computer or network resource. This kind of attack tries to prevent an Internet
site or service from functioning efficiently or at all. In general, DoS attacks are
implemented by either forcing the target to reset, to consume most of its resources
so that it can no longer provide its intended service, or to obstruct the
communication media between the intended users and the target so that they can
no longer communicate adequately.
This section describes commands used to protect against DoS attacks.
dos-protection
echo-chargen
This command protects against DoS echo/chargen attacks in which the echo
service repeats anything sent to it, and the chargen (character generator) service
generates a continuous stream of data. When used together, they create an infinite
loop and result in a denial-of-service. Use the
no
form without the bit rate
parameter to disable this feature, or with the bit rate parameter to restore the
defautl rate limit.
Syntax
[
no
]
dos-protection echo-chargen
[
bit-rate-in-kilo
rate]
rate – Maximum allowed rate. (Range: 64-2000 kbits/second)
Table 60: DoS Protection Commands
Command Function Mode
dos-protection echo-chargen Protects against DoS echo/chargen attacks GC
dos-protection smurf Protects against DoS smurf attacks GC
dos-protection tcp-flooding Protects against DoS TCP-flooding attacks GC
dos-protection tcp-null-scan Protects against DoS TCP-null-scan attacks GC
dos-protection tcp-syn-fin-scan Protects against DoS TCP-SYN/FIN-scan attacks GC
dos-protection tcp-xmas-scan Protects against DoS TCP-XMAS-scan attacks GC
dos-protection udp-flooding Protects against DoS UDP-flooding attacks GC
dos-protection win-nuke Protects against DoS WinNuke attacks GC
show dos-protection Shows the configuration settings for DoS protection PE
To Next Page
Loading...
Need help?
General