420
defense icmp-flood ip
Use
defense icmp-flood ip
to configure the action and silence thresholds for ICMP flood attack
protection of a specific IP address.
Use
undo defense icmp-flood
ip
to remove the configuration.
Syntax
defense icmp-flood ip
ip-address
rate-threshold high
rate-number
[
low
rate-number
]
undo defense icmp-flood
ip
ip-address
[
rate-threshold
]
Default
No ICMP flood attack protection thresholds are configured for an IP address.
Views
Attack protection policy view
Default command level
2: System level
Parameters
ip-address
: IP address to be protected. This IP address cannot be a broadcast address, 127.0.0.0/8,
a class D address, or a class E address.
high
rate-number
: Sets the action threshold for ICMP flood attack protection of the specified IP
address. The
rate-number
argument indicates the number of ICMP packets sent to the specified IP
address per second and is in the range of 1 to 64000. With the ICMP flood attack protection enabled,
the device enters attack detection state. When the device detects that the sending rate of ICMP
packets destined for the specified IP address constantly reaches or exceeds the specified action
threshold, the device considers the IP address to be under attack, enters attack protection state, and
takes protection actions as configured.
low
rate-number
: Sets the silence threshold for ICMP flood attack protection of the specified IP
address. The
rate-number
argument indicates the number of ICMP packets sent to the specified IP
address per second and is in the range of 1 to 64000. The default value of the silence threshold is 3/4
of the action threshold. When the device is in attack protection state, if it detects that the sending rate
of ICMP packets destined for the specified IP address drops below the silence threshold, it considers
that the attack is over, returns to attack detection state, and stops the protection actions.
Usage guidelines
You can configure ICMP flood attack protection thresholds for a maximum of 32 IP addresses in an
attack protection policy.
Examples
# Enable ICMP flood attack protection for IP address 192.168.1.2, and set the action threshold to
2000 packets per second and the silence threshold to 1000 packets per second.
<Sysname> system-view
[Sysname] attack-defense policy 1
[Sysname-attack-defense-policy-1] defense icmp-flood ip 192.168.1.2 rate-threshold high
2000 low 1000
Related commands
•
defense icmp-flood action drop-packet
•
defense icmp-flood enable
•
display attack-defense policy
