565
Syntax
fin-flood threshold threshold-value
undo fin-flood threshold
Default
The global threshold is 1000 for triggering FIN flood attack prevention.
Views
Attack defense policy view
Predefined user roles
network-admin
mdc-admin
Parameters
threshold-value
: Specifies the threshold value. The value range is 1 to 1000000 in units of FIN
packets sent to an IP address per second.
Usage guidelines
With global FIN flood attack detection configured, the device is in attack detection state. When the
sending rate of FIN packets to an IP address reaches the threshold, the device enters prevention
state and takes the specified actions. When the rate is below the silence threshold (three-fourths of
the threshold), the device returns to the attack detection state.
The global threshold applies to global FIN flood attack detection. Adjust the threshold according to
the application scenarios. If the number of FIN packets sent to a protected server, such as an HTTP
or FTP server, is normally large, set a large threshold. A small threshold might affect the server
services. For a network that is unstable or susceptible to attacks, set a small threshold.
Examples
# Set the global threshold to 100 for triggering FIN flood attack prevention in attack defense policy
atk-policy-1
.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] fin-flood threshold 100
Related commands
fin-flood action
fin-flood detect
fin-flood detect non-specific
http-flood action
Use
http-flood action
to specify global actions against HTTP flood attacks.
Use
undo http-flood action
to restore the default.
Syntax
http-flood action
{
drop
|
logging
} *
undo http-flood action
Default
No global action is specified for HTTP flood attacks.
