Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 406 / 1026

If you are unsure of the options or flag settings for the malicious packet, leave all fields
blank and the security device attempts to match the signature for all header contents.
For each value you enter, you must specify the relational or equality operator. Table 38
on page 356 lists DI attack header match modifiers.
Table 38: DI Attack Header Match Modifiers
Meaning Modifier
equal to =
not equal to !
greater than >
less than <
Additionally, for each flag you must specify whether or not a flag is configured (none),
the flag is set (set), or the flag is not set (unset).
Configure IP Header Matches
For attacks that use IP and a packet context, you can go to the IP tab to set values for
the IP fields and flags listed below. Note that in the IP header match GUI, you can select
either IPv4 or IPv6, but if you select IPv6, you can configure a new ICMPv6 header match
in the Protocol header along with existing TCP and UDP protocols. IPv4 and IPv6 header
matches cannot coexist in a single attack definition. IPv6–enabled attacks are supported
only on ISG1000 with SM and ISG2000 with SM devices.
• Type-of-Service—Specify an operand (none, =, !, >, <) and a decimal value for the
service type. Common service types are:
•
0000 Default
• 0001 Minimize Cost
•
0002 Maximize Reliability
•
0003 Maximize Throughput
• 0004 Minimize Delay
• 0005 Maximize Security
•
Packet Length—Specify an operand (none, =, !, >, <) and a decimal value for the number
of bytes in the packet, including all header fields and the data payload.
• Id—Specify an operand (none, =, !, >, <) and a decimal value for the unique value used
by the destination system to reassemble a fragmented packet.
•
Time-to-Live—Specify an operand (none, =, !, >, <) and a decimal value for the
time-to-live (TTL) value of the packet. This value represents the number of routers
the packet can pass through. Each router that processes the packet decrements the
TTL by 1; when the TTL reaches 0, the packet is discarded.
Copyright © 2010, Juniper Networks, Inc. 356
Network and Security Manager Administration Guide