Cisco SCE 8000 10GBE, Руководство по настройке программного обеспечения

Страница: 338 / 478

12-2
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Chapter 12 Identifying and Preventing Distributed Denial-of-Service Attacks
Attack Filtering and Attack Detection
Attack Filtering and Attack Detection
• Attack Filtering, page 12-2
•
Specific Attack Filtering, page 12-2
• Attack Detection, page 12-4
•
Attack Detection Thresholds, page 12-4
• Attack Handling, page 12-5
•
Hardware Filtering, page 12-6
Attack Filtering
The Cisco SCE platform includes extensive capabilities for identifying DDoS attacks, and protecting
against them.
Attack filtering is performed using specific-IP attack detectors. A specific-IP attack detector tracks the
rate of flows (total open and total suspected) in the Cisco SCE platform for each combination of IP
address (or pair of IP addresses), protocol (TCP/UDP/ICMP/Other), destination port (for TCP/UDP),
interface and direction. When the rates satisfy user-configured criteria, it is considered an attack, and a
configured action can take place (report/block, notify subscriber, send SNMP trap).
This mechanism is enabled by default, and can be disabled and enabled for each attack type
independently.
There are 32 different attack types:
• 1— TCP flows from a specific IP address on the subscriber side, regardless of destination port
•
2— TCP flows to a specific IP address on the subscriber side, regardless of destination port
• 3-4— Same as 1 and 2, but for the opposite direction (subscriber network)
•
5— TCP flows from a specific IP address on the subscriber side to a specific IP address on the
network side
• 6— Same as 5, but for the opposite direction (from the network side to the subscriber side)
•
7-12— Same as 1-6 but with a specific destination port common to all flows of the attack (1-6 are
port-less attack types, 7-12 are port-based attack types)
• 13-24— Same as 1-12 but for UDP instead of TCP
•
25-28— Same as 1-4 but for ICMP instead of TCP
• 29-32— Same as 1-4 but for Other protocols instead of TCP
Specific Attack Filtering
When the specific IP attack filter is enabled for a certain attack type, two rates are measured per defined
entity:
• Rate of new flows
•
Rate of suspected flows (In general, suspected flows are flows for which the SCOS did not see
proper establishment (TCP) or saw only a single packet (all other protocols)).