Cisco Small Business 300 1.1 Series, Administration Manual

Page: 601 / 706

Quality of Service (QoS) Commands
78-20269-01 Command Line Interface Reference Guide 603
41
41.45 security-suite dos syn-attack
Use the security-suite dos syn-attack Interface Configuration mode command to
rate limit Denial of Service (DoS) SYN attacks. This provides partial blocking of of
SNY packets (up to the rate that the user specifies).
Use the no form of this command to disable rate limiting.
Syntax
security-suite dos syn-attack
syn-rate
{
any | ip-address
} {
mask
| /
prefix-length
}
no security-suite dos syn-attack {
any | ip-address
} {
mask
| /
prefix-length
}
Parameters
•
syn-rate—Specifies the maximum number of connections per second.
(Range: 199–1000)
•
any | ip-address—Specifies the destination IP address. Use any to specify
all IP addresses.
•
mask—Specifies the network mask of the destination IP address.
•
prefix-length—Specifies the number of bits that comprise the destination IP
address prefix. The prefix length must be preceded by a forward slash (/).
Default Configuration
No rate limit is configured.
If ip-address is unspecified, the default is 255.255.255.255
If prefix-length is unspecified, the default is 32.
Command Mode
Interface Configuration (Ethernet, Port-channel) mode
User Guidelines
For this command to work, security-suite enable must be enabled both globally
and for interfaces.
This command rate limits ingress TCP packets with "SYN=1", "ACK=0" and "FIN=0"
for the specified destination IP addresses.
SYN attack rate limiting is implemented after the security suite rules are applied to
the packets. The ACL and QoS rules are not applied to those packets.