C
HAPTER
24
| General Security Measures
Denial of Service Protection
– 936 –
EXAMPLE
Console(config)#dos-protection syn-fin-scan
Console(config)#
dos-protection
tcp-xmas-scan
This command protects against DoS TCP-xmas-scan in which a so-called
TCP XMAS scan message is used to identify listening TCP ports. This scan
uses a series of strangely configured TCP packets which contain a sequence
number of 0 and the URG, PSH and FIN flags. If the target's TCP port is
closed, the target replies with a TCP RST packet. If the target TCP port is
open, it simply discards the TCP XMAS scan. Use the no form to disable
this feature.
SYNTAX
[no] dos-protection tcp-xmas-scan
DEFAULT SETTING
Enabled
COMMAND MODE
Global Configuration
EXAMPLE
Console(config)#dos-protection tcp-xmas-scan
Console(config)#
dos-protection
udp-flooding
This command protects against DoS UDP-flooding attacks in which a
perpetrator sends a large number of UDP packets (with or without a
spoofed-Source IP) to random ports on a remote host. The target will
determine that application is listening at that port, and reply with an ICMP
Destination Unreachable packet. It will be forced to send many ICMP
packets, eventually leading it to be unreachable by other clients. Use the
no form to disable this feature.
SYNTAX
dos-protection udp-flooding [bit-rate-in-kilo rate]
no dos-protection udp-flooding
rate – Maximum allowed rate. (Range: 64-2000 kbits/second)
DEFAULT SETTING
Disabled, 1000 kbits/second
COMMAND MODE
Global Configuration
To Next Page
Loading...
Need help?
General
