HP MSR SERIES

647
signature level action
Use signature level action to specify the actions against single-packet attacks of a specific level.
Use undo signature level action to restore the default.
Syntax
signature level { high | info | low | medium } action { { drop | logging } * | none }
undo signature level { high | info | low | medium } action
Default
For informational-level and low-level single-packet attacks, the action is logging.
For medium-level and high-level single-packet attacks, the actions are logging and drop.
Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
high: Specifies the high level. None of the currently supported single-packet attacks belongs to this level.
info: Specifies the informational level. For example, large ICMP packet attack is of this level.
low: Specifies the low level. For example, the traceroute attack is of this level.
medium: Specifies the medium level. For example, the WinNuke attack is of this level.
drop: Drops packets that match the specified level.
logging: Enable logging for single-packet attacks of the specified level.
none: Takes no action.
Usage guidelines
According to their severity, single-packet attacks are divided into four levels: info, low, medium, and
high.
If you enable the level-specific signature detection for single-packet attacks, the signature detection is
enabled for all single-packet attacks of the level. If you enable the signature detection for a single-packet
attack by using the signature detect command, action parameters in the signature detect command take
effect.
Examples
# Specify the action against informational level single-packet attacks as drop in attack defense policy
atk-policy-1.
<Sysname> system-view
[Sysname] attack-defense policy 1
[Sysname-attack-defense-policy-1] signature level info action drop
Related commands
• signature detect
• signature level detect