Chapter 24: General Security Measures
Denial of Service Protection
– 887 –
E
XAMPLE
Console(config)#dos-protection syn-fin-scan
Console(config)#
dos-protection
tcp-udp-port-zero
This command protects against DoS attacks in which the UDP or TCP
source port or destination port is set to zero. This technique may be used
as a form of DoS attack, or it may just indicate a problem with the source
device. Use the
no
form to restore the default setting.
S
YNTAX
dos-protection tcp-udp-port-zero
{
drop
|
forward
}
no
dos-protection tcp-udp-port-zero
drop
– Drops all packets with the Layer 4 source port or destination
port set to zero.
forward
– Forwards all packets with the Layer 4 source port or
destination port set to zero.
D
EFAULT
S
ETTING
Drop
C
OMMAND
M
ODE
Global Configuration
E
XAMPLE
Console(config)#dos-protection tcp-udp-port-zero forward
Console(config)#
dos-protection
tcp-xmas-scan
This command protects against DoS TCP-xmas-scan in which a so-called
TCP XMAS scan message is used to identify listening TCP ports. This scan
uses a series of strangely configured TCP packets which contain a sequence
number of 0 and the URG, PSH and FIN flags. If the target's TCP port is
closed, the target replies with a TCP RST packet. If the target TCP port is
open, it simply discards the TCP XMAS scan. Use the
no
form to disable
this feature.
S
YNTAX
[
no
]
dos-protection tcp-xmas-scan
D
EFAULT
S
ETTING
Enabled
C
OMMAND
M
ODE
Global Configuration
Summary of Contents for SSE-G2252
Page 42: ...44 General IP Routing on page 627...
Page 603: ...Chapter 16 IP Configuration Setting the Switch s IP Address IP Version 6 609...
Page 883: ...Chapter 24 General Security Measures Port based Traffic Segmentation 894...
Page 989: ...Chapter 30 Congestion Control Commands Automatic Traffic Control Commands 1000 Console...
Page 1007: ...Chapter 33 Address Table Commands 1019...
Page 1137: ...Chapter 38 Quality of Service Commands 1150...
