Alcatel-Lucent OmniAccess 700, Cli Configuration Manual

Page: 695 / 1193

Network Attacks - An Overview
Except on the first page, right running head:
Heading1 or Heading1NewPage text (automatic)
669
Alcatel-Lucent
Beta Beta
CLI Configuration Guide
D
EFAULT
A
TTACKS
(R
ATE
-
LIMITING
/ S
TATEFUL
)
ICMP
-
DEST
-
UNRCH
-
STORM
icmp-dest-unrch-storm [ threshold < 1-4294967295 > < 1-4294967295 >]
This attack is implicitly a part of the default attack prevention list. However, if you
do not want to use these default lists, you can turn on only a selected number of
attacks by using their respective keywords with parameters.
ICMP
-
IP
-
ADDRESS
-
SWEEP
icmp-ip-address-sweep [ threshold < 1-4294967295 > < 1-4294967295 >]
An address sweep attack occurs when one source IP address sends number of
ICMP echo requests (or pings) to different hosts within a defined interval. The
purpose of this scheme is to ping several hosts in the hope that one will reply, thus
uncovering an address to target, resulting in system failure. This command is
included in the Alcatel-Lucent’s default attack prevention list.
ICMP
-
PING
-
FLOOD
icmp-ping-flood [ threshold < 1-4294967295 > < 1-4294967295 >]
A perpetrator sends a large amount of ICMP echo (ping) traffic at IP broadcast
addresses, all of it having a spoofed source address of a victim. If the routing
device delivering traffic to the broadcast addresses performs the IP broadcast to
another broadcast function, most hosts on that IP network will take the ICMP echo
request and reply to it with an echo reply each, multiplying the traffic by the
number of hosts responding. To secure system from this kind of ping flooding, this
command is included in the default attack prevention list.
PORT
-
SCAN
port-scan [ threshold <1-4294967295> <1-4294967295> ]
A port scan is a series of messages sent by someone attempting to break into a
computer to learn which computer network services, each associated with a “well-
known” port number, the computer provides. Port scanning, a favorite approach of
computer cracker, gives the assailant an idea where to probe for weaknesses.
Essentially, a port scan consists of sending a message to each port, one at a time.
The kind of response received indicates whether the port is used and can
therefore be probed for weakness.
TCP
-
FIN
-
SCAN
tcp-fin-scan
TCP FIN flooding. To secure system from this kind of flooding, this command also
forms a part of the default list.