3-8
Virus Throttling (Connection-Rate Filtering)
General Configuration Guidelines
N o t e
On a given VLAN, to unblock the hosts that have been blocked by the
connection-rate feature, use the
vlan <
vid
> connection-rate filter unblock
command.
9.
Maintain a practice of carefully monitoring the Event Log or configured
trap receivers for any sign of high connectivity-rate activity that could
indicate an attack by malicious code. (Refer to “Connection-Rate Log and
Trap Messages” on page 3-30.)
For a network that appears to be under significant
attack:
The steps are similar to the general steps for a network that is relatively attack
free. The major difference is in policies suggested for managing hosts exhib-
iting high connection rates. This allows better network performance for
unaffected hosts and helps to identify hosts that may require updates or
patches to eliminate malicious code.
1.
Configure connection-rate filtering to
throttle
on all ports.
2.
Set global sensitivity to
medium
.
3.
If SNMP trap receivers are available in your network, use the
snmp-server
command to configure the switch to send SNMP traps.
4.
Monitor the Event Log or the available SNMP trap receivers (if configured
on the switch) to identify hosts exhibiting high connection rates.
5.
Check any hosts that exhibit relatively high connection rate behavior to
determine whether malicious code or legitimate use is the cause of the
behavior.
6.
On hosts you identify as needing attention to remove malicious behavior:
•
To immediately halt an attack from a specific host, group of hosts, or
a subnet, use the per-port block mode on the appropriate port(s).
•
After gaining control of the situation, you can use connection-rate
ACLs to more selectively manage traffic to allow receipt of normal
traffic from reliable hosts.
Summary of Contents for HP ProCurve Series 6600
Page 2: ......
Page 6: ...iv ...
Page 26: ...xxiv ...
Page 102: ...2 48 Configuring Username and Password Security Password Recovery ...
Page 204: ...4 72 Web and MAC Authentication Client Status ...
Page 550: ...10 130 IPv4 Access Control Lists ACLs General ACL Operating Notes ...
Page 612: ...12 24 Traffic Security Filters and Monitors Configuring Traffic Security Filters ...
Page 734: ...14 44 Configuring and Monitoring Port Security Operating Notes for Port Security ...
Page 756: ...16 8 Key Management System Configuring Key Chain Management ...
Page 776: ...20 Index web server proxy 14 42 webagent access 6 6 wildcard See ACL wildcard See ACL ...
Page 777: ......