Alteon Application Switch Operating System Application Guide
Advanced Denial of Service Protection
Document ID: RDWR-ALOS-V2900_AG1302
617
Example
4: A Rate Limiting Filter to Thwart Ping Flooding
This example shows how to define a filter that limits the amount of ICMP pings to any
destination behind Alteon. A ping flood attempts to overwhelm servers with ping packets, thus
removing it from service while it attempts to reply to every ping.
1. Configure the following filter.
2. Add the filter to the ingress port.
3. Apply and save the configuration.
Protection Against UDP Blast Attacks
Malicious attacks over UDP protocol ports are a common way to bring down real servers. Alteon can
be configured to restrict the amount of traffic allowed on any UDP port, thus ensuring that back-end
servers are not flooded with data.
In the CLI, you specify a series of UDP port ranges and the allowed packet limit for that range. When
the maximum number of packets per second is reached, UDP traffic is shut down on those ports.
>> # /cfg/slb/filt 30/ena
>> Filter 30 # proto icmp
(Specify ICMP protocol)
>> Filter 30 # action allow
(Allow ICMP traffic)
>> Filter 30 # adv/security
(Select the Security menu)
>> Security# ratelim ena
(Enable rate limiting)
>> Security# maxcon 10
(Specify the maximum connections
in multiples of 10)
>> Rate Limiting # /cfg/slb/port 2
(Select the appropriate ingress
port)
>> SLB port 2# filt ena
(Enable filtering on the port)
Current port 2 filtering: disabled
>> New port 2 filtering: enabled
>> SLB port 2# add 30
(Add the rate limit filter to the port)
>> Security# maxcon 10
