AsGa Light
AsGa Light
AsGa Light
AsGa LightBOLT
BOLT
BOLT
BOLT 10GigE Switch
10GigE Switch
10GigE Switch
10GigE Switch
U
U
U
User Guide
ser Guide
ser Guide
ser Guide
Configuration
Configuration
Configuration
Configuration
34
3.22.4 Denial of service attack prevention (DoS Prevention)
LightBolt family of switches have a hardware base built in mechanisms in order to detect
and refuse some of the most common DoS attacks. The following lines can be used to little
understand some of the most common attacks and explain the settings to prevent those attacks.
Denial of service
a definition:
It is an attempt to make a computer resource unavailable to its
intended users.
3.22.5 IP packet with invalid “First-fragment”
A type of attack involving fragments is known as the “tiny fragment attack”. Two TCP fragments are
created. The first fragment is so small that it does not even include the full TCP header, particularly
the destination port number. The second fragment contains the remainder of the TCP header,
including the port number. Some firewalls and intrusion detection systems may let one or both
fragments pass through, particularly if they do not perform packet reassembly. Under this setting if the
first fragment of the packet does not have a full TCP header length the packet will be dropped.
COMMAND
DESCRIPTION
AsGOS#
configure terminal
Enter the
Configure
mode.
AsGOS(config)#
denial-of-service
Enter into Dos mode configuration
AsGOS(config-dos)#
first-fragment-ip-packets
enable
Enable the first fragment DoS Checking.
All packets detected under those conditions will be discarded.
3.22.6 Fragmented ICMP packets - icmp-attack-check
This type of attack sends the victim's computer a series of highly fragmented, oversized
ICMP data packets over the connection. The computer receiving the data packets locks when it tries
to put the fragments together.
If the TCP/IP stack was not built properly, when it tries to keep track and put together
several packets, the result is a memory overflow, which in turn causes the machine to stop
responding. Usually, the attacker only needs to send a few packets, locking the victim's computer
instantaneously. When the victim restarts his or her computer, the connection with the attacker is lost
and the attacker remains anonymous.
Under this setting the system will check for highly ICMP fragmented packet and ICMP Ping
Packets with payloads mayors than those specified by “minimun-icmp-packet-over-size”.
Default
value 256.
COMMAND
DESCRIPTION
AsGOS#
configure terminal
Enter the Configure mode.
AsGOS(config)#
denial-of-service
Enter into Dos mode configuration.
AsGOS(config-dos)#
icmp-attack-check enable
Enable ICMP DoS attack checking.
AsGOS(config-dos)#
minimun-icmp-packet-over-
size 512
Modify the minimum packet oversize ICMP
packet size.
AsGOS(config-dos)#
end
All packets detected under those conditions will be discarded.
