. . . . .
C O N F I G U R I N G A T T A C K P R E V E N T I O N
User Guide
4-3
Enabling DDoS Logging
Logging messages are generated by logging modules inside the appliance.
Logging modules that generate DDoS-related messages are in the policy module, the dos module
and the reconn-deter module.
All DDoS-related logging is generated at the 'informational' level (meaning that the levels are
compatible with the syslog message levels).
The following list describes how logging is enabled per attack category.
• Flooding attacks: Use the following command to enable logging for all flooding attacks:
set log module dos level information
• Port Attacks: Use the following command to enable logging for all port attacks:
set log module policy level information
• Attacks through malformed packets: Use the following commands for this category:
set log module reconn-deter level information
set log module ip level information
Some attacks require the use of only one of the above commands. See
Table 4-1
for details.
• Attacks through valid but potentially dangerous packets: Use the following commands for
this category:
set log module reconn-deter level information
set log module dos level information
Some attacks require the use of only one of the above commands. See
Table 4-1
for details.
Attack Overview Table
The following table lists the attack prevention features that the AntiDoS feature
supports. Use the
Index column in this table with the
Logging Command Index
in
Table 4-2
.
Table 4-1: Attack Overview
Attack Name
Category
How to enable
attack prevention
How to enable
logging (for a specific
attack)
Index
Logging Message
Back-orifice
port attack set policy global
port-attack
back-orifice
set log module
policy level
information
See A packet dropped due to
policy deny!
Ini-killer
port attack set policy global
port-attack ini-
killer
set log module
policy level
information
See A packet dropped due to
policy deny!
Priority
port attack set policy global
port-attack
priority
set log module
policy level
information
See A packet dropped due to
policy deny!
Ripper
port attack set policy global
port-attack
ripper
set log module
policy level
information
See A packet dropped due to
policy deny!
Summary of Contents for freeGuard Slim 100
Page 10: ...FSL100 User Guide x ...
Page 24: ...G E T T I N G ST A R T E D 1 1 14 User Guide ...
Page 42: ...SY S T E M M A NA G E M E N T 2 2 18 User Guide ...
Page 50: ...M A N A G I N G T R A F F IC F L O W 3 3 8 User Guide ...
Page 58: ...C O N F IG U R I N G A TT A C K PRE VE N T I O N 4 4 8 User Guide ...
Page 84: ...T R A F F I C F LO W R E P O R T I N G 5 5 26 User Guide ...
Page 122: ...M O N I T O R I N G T R A FF I C 7 7 16 User Guide ...
Page 134: ...U SI N G S N M P 8 8 12 User Guide ...
Page 166: ...A L PH AB E T I C LI S T I NG OF LO G M E SS AG E S C C 4 User Guide ...
Page 170: ...N O TI F I C A T I O N A N D S A F E T Y ST A TE M E N T S Battery Statement D D 4 User Guide ...
