Edge-Core ECS4210-12P - Dos-Protection Tcp Xmas-Scan

Chapter 8 | General Security Measures
Denial of Service Protection
– 307 –
dos-protection tcp
xmas-scan
This command protects against TCP Xmas-scan in which a so-called TCP Xmas scan
message is used to identify listening TCP ports. This scan uses a series of strangely
configured TCP packets which contain a sequence number of 0 and the URG, PSH
and FIN flags. If the target's TCP port is closed, the target replies with a TCP RST
packet. If the target TCP port is open, it simply discards the TCP Xmas scan. Use the
no form to disable this feature.
Syntax
[no] dos-protection tcp xmas-scan
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
In these packets, FIN=1, URG= 1 and PSH = 1.
Example
Console(config)#dos-protection tcp xmas-scan
Console(config)#
Protection for UDP
dos-protection udp
blat-block
This command protects against attacks in which a specially crafted packet is sent to
a host where the source host port is the same as the destination host port. The
system attempts to reply to itself, resulting in system lockup.
Syntax
[no] dos-protection udp blat-block
Default Setting
Disabled
Command Mode
Global Configuration
Example
Console(config)#dos-protection udp blat-block
Console(config)#