Supermicro SSE-G2252, User Manual

Page: 873 / 1401

Chapter 24: General Security Measures
Denial of Service Protection
– 884 –
E
XAMPLE
Console#show ip arp inspection vlan 1
VLAN ID DAI Status ACL Name ACL Status
-------- --------------- -------------------- --------------------
1 disabled sales static
Console#
D
ENIAL OF
S
ERVICE
P
ROTECTION
A denial-of-service attack (DoS attack) is an attempt to block the services
provided by a computer or network resource. This kind of attack tries to
prevent an Internet site or service from functioning efficiently or at all. In
general, DoS attacks are implemented by either forcing the target to reset,
to consume most of its resources so that it can no longer provide its
intended service, or to obstruct the communication media between the
intended users and the target so that they can no longer communicate
adequately.
This section describes commands used to protect against DoS attacks.
dos-protection
echo-chargen
This command protects against DoS echo/chargen attacks in which the
echo service repeats anything sent to it, and the chargen (character
generator) service generates a continuous stream of data. When used
together, they create an infinite loop and result in a denial-of-service. Use
the no form to disable this feature.
S
YNTAX
dos-protection echo-chargen [ bit-rate-in-kilo rate ]
no dos-protection echo-chargen
Table 24-13: DoS Protection Commands
Command Function Mode
dos-protection echo-chargen Protects against DoS echo/chargen attacks GC
dos-protection smurf Protects against DoS smurf attacks GC
dos-protection tcp-flooding Protects against DoS TCP-flooding attacks GC
dos-protection tcp-null-scan Protects against DoS TCP-null-scan attacks GC
dos-protection tcp-syn-fin-scan Protects against DoS TCP-SYN/FIN-scan attacks GC
dos-protection
tcp-udp-port-zero
Protects against attacks which set the Layer 4
source or destination port to zero
GC
dos-protection tcp-xmas-scan Protects against DoS TCP-XMAS-scan attacks GC
dos-protection udp-flooding Protects against DoS UDP-flooding attacks GC
dos-protection win-nuke Protects against DoS WinNuke attacks GC
show dos-protection Shows the configuration settings for DoS
protection
PE