1078
• option-code: Specifies the IP option in the range of 0 to 255.
• internet-timestamp: Specifies the timestamp option.
• loose-source-routing: Specifies the loose source routing option.
• record-route: Specifies the record route option.
• route-alert: Specifies the route alert option.
• security: Specifies the security option.
• stream-id: Specifies the stream identifier option.
• strict-source-routing: Specifies the strict source route option.
ip-option-abnormal: Specifies the abnormal IP option attack.
ipv6-ext-header ext-header-value: Specifies an IPv6 extension header by its value in the range of 0
to 255.
land: Specifies the Land attack.
large-icmp: Specifies the large ICMP packet attack.
large-icmpv6: Specifies the large ICMPv6 packet attack.
ping-of-death: Specifies the ping-of-death attack.
smurf: Specifies the smurf attack.
snork: Specifies the UDP snork attack.
tcp-all-flags: Specifies the attack where the TCP packet has all flags set.
tcp-fin-only: Specifies the attack where the TCP packet has only the FIN flag set.
tcp-invalid-flags: Specifies the attack that uses TCP packets with invalid flags.
tcp-null-flag: Specifies the attack where the TCP packet has no flags set.
tcp-syn-fin: Specifies the attack where the TCP packet has both SYN and FIN flags set.
teardrop: Specifies the teardrop attack.
tiny-fragment: Specifies the tiny fragment attack.
traceroute: Specifies the traceroute attack.
udp-bomb: Specifies the UDP bomb attack.
winnuke: Specifies the WinNuke attack.
action: Specifies the actions against the single-packet attack. If you do not specify this keyword, the
default action of the attack level to which the single-packet attack belongs is used.
drop: Drops packets that match the specified signature.
logging: Enables logging for the specified single-packet attack.
none: Takes no action.
Usage guidelines
You can use this command multiple times to enable signature detection for multiple single-packet
attack types.
When you specify a packet type by a number, if the packet type has a corresponding keyword, the
keyword is displayed in command output. If the packet type does not have a corresponding keyword,
the number is displayed.
Examples
# Enable signature detection for smurf attack and specify the prevention action as drop in the attack
defense policy atk-policy-1.
<Sysname> system-view
To Next Page
Loading...
