Fujitsu PRIMERGY BX900 - Denial-Of-Service

© 2011 Fujitsu Technology Solutions
320
9.4.11 Denial-of-Service
9.4.11.1 Config
Figure : Denial-of-Service Config
Configurable Data
SIP=DIP - Enable or disable this option by selecting the corresponding line on the pull down entry
field. Enabling SIP=DIP DoS prevention causes the switch to drop packets that have a source IP
address equal to the destination IP address. The factory default is disabled.
First Fragment - Enable or disable this option by selecting the corresponding line on the pull down
entry field. Enabling First Fragment DoS prevention causes the switch to drop packets that have a
TCP header smaller then the configured Min TCP Hdr Size. The factory default is disabled.
Min TCP Hdr Size - Specify the Min TCP Hdr Size allowed. If First Fragment DoS prevention is
enabled, the switch will drop packets that have a TCP header smaller then this configured Min TCP
Hdr Size. The factory default is disabled. (Note: This attribute is provided in stackable Ethernet
Connection Blade)
TCP Fragment - Enable or disable this option by selecting the corresponding line on the pull down
entry field. Enabling TCP Fragment DoS prevention causes the switch to drop packets that have an
IP fragment offset equal to 1. The factory default is disabled.
TCP Flag - Enable or disable this option by selecting the corresponding line on the pull down entry
field. Enabling TCP Flag DoS prevention causes the switch to drop packets that have TCP flag SYN
set and TCP source port less than 1024 or TCP control flags set to 0 and TCP sequence number set
to 0 or TCP flags FIN, URG, and PSH set and TCP sequence number set to 0 or both TCP flags
SYN and FIN set. The factory default is disabled.
L4 Port - Enable or disable this option by selecting the corresponding line on the pull down entry
field. Enabling L4 Port DoS prevention causes the switch to drop packets that have TCP/UDP source
port equal to TCP/UDP destination port. The factory default is disabled.
ICMP - Enable or disable this option by selecting the corresponding line on the pull down entry field.
Enabling ICMP DoS prevention causes the switch to drop ICMP packets that have a type set to
ECHO_REQ (ping) and a size greater than the configured ICMP Pkt Size. The factory default is
disabled.