IP Configuration
Configuring IP
page 15-24
OmniSwitch AOS Release 7 Network Configuration Guide
June 2013
•
Multicast IP and MAC Address Mismatch—This attack is detected when:
•
the source MAC address of a packet received by a switch is a Multicast MAC address.
•
the destination IP and MAC addresses of a packet received by a switch is same as the Multicast IP
and MAC addresses, but the Multicast IP and the Multicast MAC addresses do not match.
Note.
In both the conditions described above in “Multicast IP and MAC Address Mismatch”, packets are
dropped and SNMP traps are generated.
•
the destination IP is a unicast IP and the destination MAC address is either a Broadcast or Multicast
address. In such a condition, an event is recorded in the DoS statistics. No SNMP traps are
generated as valid packets can also fall under this category.
•
Ping overload—Floods a switch with a large number of ICMP packets, resulting in the switch using a
large amount of CPU time to respond to these packets. If the number of ICMP packets exceed 100 per
second, a DoS attack is detected. By default, the detection of attack is disabled.
•
Packets with loopback source IP address—Packets with an invalid source address of 127.0.0.0/8
(loopack network) are received by the switch. When such packets are detected, they are dropped, and
SNMP traps are generated.
The switch can be set to detect various types of port scans by monitoring for TCP or UDP packets sent to
open or closed ports. Monitoring is done in the following manner:
•
Packet penalty values set
. TCP and UDP packets destined for open or closed ports are assigned a
penalty value. Each time a packet of this type is received, its assigned penalty value is added to a
running total. This total is cumulative and includes all TCP and UDP packets destined for open or
closed ports.
•
Port scan penalty value threshold
. The switch is given a port scan penalty value threshold. This
number is the maximum value the running penalty total can achieve before triggering an SNMP trap.
•
Decay value
. A decay value is set. The running penalty total is divided by the decay value every
minute.
•
Trap generation
. If the total penalty value exceeds the set port scan penalty value threshold, a trap is
generated to alert the administrator that a port scan can be in progress.
For example, imagine that a switch is set so that TCP and UDP packets destined for closed ports are given
a penalty of 10, TCP packets destined for open ports are given a penalty of 5, and UDP packets destined
for open ports are given a penalty of 20. The decay is set to 2, and the switch port scan penalty value
threshold is set to 2000:
Invalid Destination IP
address
•
127.x.x.x.
•
in the range 240.x.x.x - 255.255.255.254.
•
0.0.0.0 (valid exceptions- certain DHCP packets).
•
172.28.0.0 for a router network 172.28.4.11/16.
•
0.x.x.x.