Alcatel-Lucent OmniAccess 700, Cli Configuration Manual

Page: 694 / 1193

Filter and Firewall
Left running head:
Chapter name (automatic)
668
Beta Beta
CLI Configuration Guide
Alcatel-Lucent
N
ETWORK
A
TTACKS
- A
N
O
VERVIEW
A Denial-of-Service (DoS) attack is a malicious attempt by one or many users to
limit or completely disable the availability of a service.
They cost businesses millions of dollars each year and are a serious threat to any
system or a network. These costs are related to system downtime, lost revenues
and the labour involved in identifying and reacting to such attacks.
Not all service outages, even those that result from malicious activity, are
necessarily denial-of-service attacks. Other types of attack may include a denial of
service as a component, but the denial of service may be part of a larger attack.
Illegitimate use of resources may also result in denial of service.
For example, an intruder may use anonymous FTP area as a place to store illegal
copies of commercial software, consuming disk space and generating network
traffic. Denial-of-service attacks come in a variety of forms and aim at a variety of
services.
There are three basic types of attacks:
•
Consumption of scarce, limited, or non-renewable resources.
•
Destruction or alteration of configuration information.
•
Physical destruction or alteration of network components.
The OA-700 provides an effective way to prevent these attacks against their
networks. The OA-700 employs rate limiting and rule based filtering to prevent
these attacks. The following sections describe usage guidelines to configure the
system to protect against these attacks.
T
YPES OF
N
ETWORK
A
TTACKS
The following sections give a concise overview on all the rate-limiting and non-
rate-limiting attacks that can be prevented by the OA-700. The attacks are further
classified into:
•
“Default Attacks (Rate-limiting / Stateful)”
•
“Default Attacks (Non-rate Limiting / Stateless)”
•
“Optional Attacks”
The Default Attacks are the ones that are present in the default attack prevention
list of the OA-700. These attacks can be either manually turned on for detection or
filters can be applied to block them.
“To Configure Default Attacks (Rate Limiting /
Non-rate Limiting) for an Attack Object”
The Optional Attacks are the ones that are not present in the default attack
prevention list of the OA-700. These attacks too can be either manually turned on
for detection or filters can be applied to block them.
“To Configure Individual
Attack for an Attack Object”