C613-50170-01 Rev B
Command Reference for x510 Series
1549
AlliedWare Plus™ Operating System - Version 5.4.7-1.x
IP
V
4 S
OFTWARE
A
CCESS
C
ONTROL
L
IST
(ACL) C
OMMANDS
DOS
Type of DoS attack
Description
ipoptions
This type of attack occurs when an attacker sends packets
containing bad IP options to a victim node. There are many
different types of IP options attacks and this software does not
try to distinguish between them. Rather, if this defense is
activated, the number of ingress IP packets containing IP
options is counted. If the number exceeds 20 packets per
second, the switch considers this a possible IP options attack.
This defense does not require the CPU to monitor packets, so
does not put extra load on the switch's CPU.
land
This type of attack occurs when the Source IP and Destination IP
address are the same. This can cause a target host to be
confused. Since packets with the same source and destination
addresses should never occur, these packets are dropped when
this attack is enabled.
This defense does not require the CPU to monitor packets, so
does not put extra load on the switch's CPU.
ping-of-death
This type of attack results from a fragmented packet which,
when reassembled, would exceed the maximum size of a valid
IP datagram. To detect this attack, the final fragment of ICMP
packets has to be sent to the CPU for inspection. This defense
can therefore load the CPU.
Note that the extra CPU load will not affect normal traffic
switching between ports, but other protocols such as IGMP and
STP may be affected. This defense is not recommended where a
large number of fragmented packets are expected.
smurf
This type of attack is an ICMP ping packet to a broadcast
address. Although routers should not forward packets to local
broadcast addresses anymore (see RFC2644), the Smurf attack
can still be explicitly discarded with this command. In order for
the Smurf attack to work, the broadcast IP address is required.
Any ICMP Ping packet with this destination address is
considered an attack.
This defense does not require the CPU to monitor packets, so
does not put extra load on the switch's CPU.
synflood
In this type of attack, an attacker, seeking to overwhelm a victim
with TCP connection requests, sends a large number of TCP SYN
packets with bogus source addresses to the victim. The victim
responds with SYN ACK packets, but since the original source
addresses are bogus, the victim node does not receive any
replies. If the attacker sends enough requests in a short enough
period, the victim may freeze operations once the requests
exceed the capacity of its connections queue.
To defend against this form of attack, a switch port monitors the
number of ingress TCP-SYN packets it receives. An attack is
recorded if a port receives more 60 TCP-SYN packets per second.
teardrop
In this DoS attack, an attacker sends a packet in several
fragments with a bogus offset value, used to reconstruct the
packet, in one of the fragments to a victim. This results in the
victim being unable to reassemble the packet, possibly causing
it to freeze operations.
