10-22
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Chapter 10 Identifying and Preventing Distributed-Denial-Of-Service Attacks
Monitoring Attack Filtering
•
'protocol'
–
TCP
–
UDP
–
ICMP
–
other
•
'rate1' and 'rate2' are numbers
•
'duration' is a number.
•
'total-flows' is one of the following strings, depending on the attack action:
–
If 'action' is block: 'number' flows blocked.
–
If 'action' is report: attack comprised of 'number' flows.
•
'hw-filter'
–
If the attack was not filtered by a hardware filter: empty string
–
If the attack was filtered by a hardware filter: HW filters used, actual attack duration is probably
smaller than reported above, actual amount of flows handled is probably larger than reported
above.
Monitoring Attack Filtering Using CLI Commands
•
How to display a specified attack detector configuration, page 10-23
•
How to display the default attack detector configuration, page 10-24
•
How to display all attack detector configurations, page 10-25
•
How to display filter state (enabled or disabled), page 10-25
•
How to display configured threshold values and actions, page 10-25
•
How to display the current counters, page 10-27
•
How to display all currently handled attacks, page 10-27
•
How to display all existing force-filter settings, page 10-27
•
How to display all existing don't-filter settings, page 10-27
•
How to display the list of ports selected for subscriber notification, page 10-27
•
How to find out whether hardware attack filtering has been activated, page 10-28
Use these commands to monitor attack detection and filtering:
•
show interface linecard 0 attack-detector
•
show interface linecard 0 attack-filter
•
show interface linecard 0 attack-filter query
•
show interface linecard 0 attack-filter current-attacks
•
show interface linecard 0 attack-filter don't-filter
•
show interface linecard 0 attack-filter force-filter
•
show interface linecard 0 attack-filter subscriber-notification ports
