Alteon Application Switch Operating System Application Guide
Advanced Denial of Service Protection
618
Document
ID:
RDWR-ALOS-V2900_AG1302
To configure UDP blast protection
1. Configure the UDP port numbers or ranges of UDP ports that you want to protect against UDP
attacks.
For example, configure UDP ports 1001-2000 @ 1000pps, UDP ports 2001-4000 @2000pps, and
UDP ports 4001-6000 @5000pps.
Alteon supports up to 5000 UDP port numbers, using any integer from 1 to 65535. For the entire
port range, the difference between the highest port number and the lowest port number must
be less than or equal to 5000.
2. Enable UDP blast protection on the ports that are connected to unsafe networks.
3. Apply and save the configuration.
TCP or UDP Pattern Matching
This feature provides the capability to scan ingressing packets for patterns contained in some well-
known TCP or UDP attacks on back-end servers. Alteon can be configured with one or more filters
that scan the first IP packet, and drop if it finds one or all of the configured patterns. If no match is
found, the packets are allowed through.
Pattern matching is constructed much in the same way as any other filter configured to examine
Layer 7 content.
Note:
The ability to match and perform filter action on a pattern or group of patterns is available
only when you enable the Security Pack software.
Pattern Criteria
Many TCP or UDP attacks contain common signatures or patterns in the IP packet data. Alteon can
be configured to examine an IP packet from either the beginning, from a specific offset value
(starting point) within the IP packet, and/or from a specified depth (number of characters) into the
IP packet. It then performs a matching operation.
Figure 100 - IP Packet Format, page 619
illustrates an IP packet format. Alteon is able to track from
the beginning of the IP packet (at the IP version number), through an IP packet payload of 1500
bytes. Each row in an IP packet is four bytes.
>> /cfg/security/udpblast
>> UDP Blast Protection# add
Enter UDP port number (1 to 65535) or range (first-last): 1001-2000
Enter max packet rate per second (1 to 20000000): 1000
>> UDP Blast Protection# add
Enter UDP port number (1 to 65535) or range (first-last): 2001-4000
Enter max packet rate per second (1 to 20000000): 2000
>> UDP Blast Protection# add
Enter UDP port number (1 to 65535) or range (first-last): 4001-6000
Enter max packet rate per second (1 to 20000000): 5000
>> /cfg/security/port 1/udpblast ena
