Dell PowerConnect B-FCXs, Configuration Manual

Page: 1381 / 1494

PowerConnect B-Series FCX Configuration Guide 1339
53-1002266-01
Chapter
38
Protecting Against Denial of Service Attacks
Table 232 lists individual Dell PowerConnect switches and the DoS protection features they
support.
This chapter explains how to protect your Dell PowerConnect devices from Denial of Service (DoS)
attacks.
In a Denial of Service (DoS) attack, a router is flooded with useless packets, hindering normal
operation. Dell PowerConnect devices include measures for defending against two types of DoS
attacks Smurf attacks and TCP SYN attacks.
Protecting against Smurf attacks
A Smurf attack is a kind of DoS attack in which an attacker causes a victim to be flooded with
Internet Control Message Protocol (ICMP) echo (Ping) replies sent from another network.
Figure 174 illustrates how a Smurf attack works.
FIGURE 174
How a Smurf attack floods a victim with ICMP replies
The attacker sends an ICMP echo request packet to the broadcast address of an intermediary
network. The ICMP echo request packet contains the spoofed address of a victim network as its
source. When the ICMP echo request reaches the intermediary network, it is converted to a Layer 2
broadcast and sent to the hosts on the intermediary network. The hosts on the intermediary
network then send ICMP replies to the victim network.
TABLE 232 Supported DoS protection features
Feature PowerConnect B-Series FCX
Smurf attack (ICMP attack) protection Yes
TCP SYN attack protection Yes
2
1
3
Attacker
Intermediary
Victim
Att a cker s end s ICMP echo req u e s t s to
bro a dc as t a ddre ss on Intermedi a ry’ s
network, s poofing Victim’ s IP a ddre ss
as the s o u rce
If Intermedi a ry h as directed bro a dc as t
forw a rding en a bled, ICPM echo req u e s t s
a re bro a dc as t to ho s t s on Intermedi a ry’ s
network
The ho s t s on Intermedi a ry’ s network
s end replie s to Victim, in u nd a ting Victim
with ICPM p a cket s