Extreme Networks ExtremeWare 7.2e, Installation And User Manual

Page: 169 / 344

Denial of Service Protection
ExtremeWare 7.2e Installation and User Guide 169
For example, to review the DoS traffic for port 1, issue this command:
sh cpu-dos-protect ports 1
The output from this command follows:
* ex160:22 # sh cpu-dos-protect ports 1
Cpu dos protect: enabled
Port L3Miss L3Err Bcast IpUnkMcast Learn Curr Int Cfg Thr Cfg Int Pass
______________________________________________________________________
1 150 150 150 150 150 1 150 1 3
Trusted ports: none
The output of this show command displays the following information, which can help you analyze the
type of activity coming across the port to the CPU:
• The status of DoS Protection on the port
• Layer 3 miss to the CPU
These are packets that do not have corresponding IPFDB entries on VLANs, which are enabled for IP
forwarding. Packets that are unicasted to the CPU IP are also considered in this category.
• Layer 3 error
These are IP packets with options, IPMC packets (but not class D address) with checksum errors,
and non-IP packets.
• Broadcast traffic
• IP multicast unknown
These are IPMC packets that do not have corresponding IPMC FDB entries.
•
Learning packets
These are packets that do not have a corresponding FDB entries.
• Current interval
The current time interval, less than or equal to the configured interval.
• Configured alert threshold
The maximum number of packets that can be sent to the CPU during the configured interval. This
variable is equal to the configured interval parameter in seconds for each traffic category.
•
Configured interval
This variable is equal to the configured interval parameter in seconds for each traffic category.
• Free pass indicator (Zero in this field indicates a free pass for three intervals after the port comes
up.)
• Trusted port status
Creating Trusted Ports
In some cases, traffic from a switch port or group of ports will never cause an attack. These ports can be
configured as trusted ports and are not examined under DoS criteria. Trusted ports can prevent
innocent hosts from being blocked, or ensure that when an innocent host responds to an attack that the