Configuring IP
IP Configuration
OmniSwitch AOS Release 7 Network Configuration Guide
June 2013
page 15-25
.
In 1 minute, 10 TCP closed port packets and 10 UDP closed port packets are received. This brings the
total penalty value to 200, as shown using the following equation:
(10 TCP X 10 penalty) + (10 UDP X 10 penalty) = 200
This value would be divided by 2 (due to the decay) and decreased to 100. The switch would not record a
port scan:
In the next minute, 10 more TCP and UDP closed port packets are received, along with 200 UDP
open port packets. This would bring the total penalty value to 4300, as shown using the following equa-
tion:
(100 previous minute value) + (10 TCP X 10 penalty) + (10 UDP X 10 penalty) +
(200 UDP X 20 penalty) = 4300
This value would be divided by 2 (due to decay) and decreased to 2150. The switch would record a port
scan and generate a trap to warn the administrator:
DoS Settings
UDP/TCP closed = 10
UDP open = 20
TCP open = 5
Threshold = 2000
Decay = 2
Penalty Total = 0
DoS Settings
UDP/TCP closed = 10
UDP open = 20
TCP open = 5
Threshold = 2000
Decay = 2
Minute 1 Penalty Total = 100
Do Not
Generate DoS
Attack Warning
Trap
10 TCP closed port packets
10 UDP closed port packets