888
Parameters
client-verify
: Adds the victim IP addresses to the protected IP list for TCP client verification. If TCP
client verification is enabled, the device provides proxy services for protected servers.
drop
: Drops subsequent FIN packets destined for the victim IP addresses.
logging
: Enables logging for FIN flood attack events.
Usage guidelines
For the FIN flood attack detection to collaborate with the TCP client verification, make sure the
client-verify
keyword is specified and the TCP client verification is enabled. To enable TCP client
verification, use the
client-verify tcp enable
command.
Examples
# Specify
drop
as the global action against FIN flood attacks in the attack defense policy
atk-policy-1
.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] fin-flood action drop
Related commands
client-verify tcp enable
fin-flood detect
fin-flood detect non-specific
fin-flood threshold
fin-flood detect
Use
fin-flood detect
to configure IP address-specific FIN flood attack detection.
Use
undo fin-flood detect
to remove the IP address-specific FIN flood attack detection
configuration.
Syntax
fin-flood detect
{
ip
ipv4-address
|
ipv6
ipv6-address
} [
vpn-instance vpn-instance-name
]
[
threshold threshold-value
] [
action
{ {
client-verify
|
drop
|
logging
} * |
none
} ]
undo fin-flood detect
{
ip
ipv4-address
|
ipv6
ipv6-address
} [
vpn-instance vpn-instance-name
]
Default
IP address-specific FIN flood attack detection is not configured.
Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
ip
ipv4-address
: Specifies the IPv4 address to be protected. The
ipv4-address
argument cannot be
255.255.255.255 or 0.0.0.0.
ipv6
ipv6-address
: Specifies the IPv6 address to be protected.
vpn-instance vpn-instance-name
: Specifies the MPLS L3VPN instance to which the protected IP
address belongs. The
vpn-instance-name
argument is a case-sensitive string of 1 to 31 characters.
Do not specify this option if the protected IP address is on the public network.
Summary of Contents for FlexNetwork MSR Series
Page 1005: ...987 ...
