36-8
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 36 Configuring Denial of Service Protection
Understanding How DoS Protection Works
Hardware-Based Rate Limiters on the PFC2
The PFC2 supports additional hardware-based rate limiters. The PFC2 provides four rate-limiter
registers for the new rate limiters, which are configured globally on the router. These rate-limiter
registers are present in the Layer 3 forwarding engine (PFC) and are responsible for containing
rate-limiting information for result packets that match the various available configured rate limiters.
Because four rate-limiter registers are present on the Layer 3 forwarding engine only, these registers can
force different rate-limiting scenarios to share the same register. The registers are assigned on a
first-come, first-serve basis. If all registers are being utilized, the only way to configure another rate
limiter is to free one register.
The hardware-based rate limiters available on the PFC2 are as follows:
•
Ingress and egress ACL bridged packets
•
FIB receive and FIB glean cases
•
VACL log
•
Layer 3 features
Ingress-Egress ACL Bridged Packets (Unicast Only)
This rate limiter rate limits packets sent to the MSFC because of an ingress/egress ACL bridge result.
The router accomplishes this by altering existing and new ACL TCAM entries with a TCAM bridge
result to a Layer 3 redirect result pointing to the MSFC. Packets hitting the TCAM entries with the
altered Layer 3 redirect rate limit result will be rate limited according to the instructions set in CLI by
the network administrator. Both the ingress and egress values will be the same, as they both share the
same rate-limiter register. If the ACL bridge ingress/egress rate limiting is disabled, the Layer 3 redirect
rate limit results are converted to the bridge result.
Router(config)#
ip tcp intercept
max-incomplete
low
number
Defines the number of incomplete connections
below which the software leaves aggressive mode;
valid values are from 1 to 2147483647
connections.
Router(config)#
ip tcp intercept
max-incomplete high
number
Defines the maximum number of incomplete
connections allowed before the software enters
aggressive mode; valid values are from 1 to
2147483647 connections.
Router(config)#
ip tcp intercept one-minute
low
number
Defines the number of connection requests below
which the software leaves aggressive mode; valid
values are from 1 to 2147483647 connections.
Router(config)#
ip tcp intercept one-minute
high
number
Defines the number of connection requests
received in the last one-minutes sample period
before the software enters aggressive mode; valid
values are from 1 to 2147483647 connections.
Router#
show tcp intercept connections
Displays incomplete connections and established
connections.
Router#
show tcp intercept statistics
Displays TCP intercept statistics.
Table 36-1 TCP Intercept Configuration (continued)
Command
Purpose
