H3C MSR Series Command Reference

1050
Parameters
port-list: Specifies a space-separated list of up to 65535 port number items. Each item specifies a
port by its port number or a range of ports in the form of start-port-number to end-port-number. The
end-port-number cannot be smaller than the start-port-number.
Usage guidelines
The device detects only DNS packets destined for the specified ports.
The global ports apply to global DNS flood attack detection and IP address-specific DNS flood attack
detection with no port specified.
Examples
# Specify the ports 53 and 61000 as the global ports to be protected against DNS flood attacks in the
attack defense policy atk-policy-1.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] dns-flood port 53 61000
Related commands
dns-flood action
dns-flood detect
dns-flood detect non-specific
dns-flood threshold
Use dns-flood threshold to set the global threshold for triggering DNS flood attack prevention.
Use undo dns-flood threshold to restore the default.
Syntax
dns-flood threshold threshold-value
undo dns-flood threshold
Default
The global threshold is 1000 for triggering DNS flood attack prevention.
Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
threshold-value: Specifies the threshold value. The value range is 1 to 1000000 in units of DNS
packets sent to an IP address per second.
Usage guidelines
The global threshold applies to global DNS flood attack detection. Adjust the threshold according to
the application scenarios. If the number of DNS packets sent to a protected DNS server is normally
large, set a large threshold. A small threshold might affect the server services. For a network that is
unstable or susceptible to attacks, set a small threshold.
With global DNS flood attack detection configured, the device is in attack detection state. When the
sending rate of DNS packets to an IP address reaches the threshold, the device enters prevention
state and takes the specified actions. When the rate is below the silence threshold (three-fourths of
the threshold), the device returns to the attack detection state.

H3C MSR Series Specifications

General

Category	Network Router
IPv6 Support	Yes
Dimensions	Varies by model
Weight	Varies by model
Product Type	Modular Router
Ports	Varies by model
WAN Interfaces	Varies by model
Firewall	Yes
QoS	Yes
Wireless Support	Varies by model
USB Ports	Varies by model
Console Port	Yes
Power Supply	Varies by model
Redundancy	Varies by model
Operating Temperature	0°C to 45°C
Storage Temperature	-40°C to 70°C
Humidity	5% to 95% non-condensing
Series	MSR
Certifications	CE, FCC, RoHS