10-17
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
OL-16479-01
Chapter 10 Identifying and Preventing Distributed-Denial-Of-Service Attacks
Subscriber Notifications
Subscriber Notifications
•
Configuring the Subscriber Notification Port, page 10-17
•
How to Remove the Subscriber Notification Port, page 10-17
Subscriber notification is a capability used- for notifying a subscriber in real-time about current attacks
involving IP addresses mapped to that subscriber. Subscriber notification is configured on a
per-attack-detector level, as explained above, and must also be enabled and configured by the application
loaded to the SCE platform, as explained in the appropriate Service Control Application user guide.
In the current solutions, the SCE Platform notifies the subscriber about the attack by redirecting HTTP
flows originating from the subscriber to the service provider’s server, that should notify the subscriber
that he is under attack. This raises a question regarding TCP attacks originating from the subscriber that
are configured with block action. Such attacks cannot normally be notified to the subscriber using HTTP
redirection, since all HTTP flows originating from the subscriber are TCP flows, and they are therefore
blocked along with all other attack flows. To enable effective use of HTTP redirect, there is a CLI
command that prevents blocking of TCP flows originating from the subscriber to a specified TCP port,
even when the above scenario occurs.
Configuring the Subscriber Notification Port
You can define a port to be used as the subscriber notification port. The attack filter will never block TCP
traffic from the subscriber side of the SCE platform to this port, leaving it always available for subscriber
notification.
Options
The following option is available:
•
portnumber
— the number of the port to be used as the subscriber notification port
Step 1
From the SCE(config if)# prompt, type
attack-filter subscriber-notification ports
portnumber
and
press
Enter
.
How to Remove the Subscriber Notification Port
Step 1
From the SCE(config if)# prompt, type
no attack-filter subscriber-notification ports
and press
Enter
.