12-4
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Chapter 12 Identifying and Preventing Distributed Denial-of-Service Attacks
Attack Filtering and Attack Detection
Attack Detection
Specific IP detections are identified with the following parameters:
•
Specific IP address (or two IP addresses for dual-sided detections)
•
Protocol—TCP, UDP, ICMP or Other
•
Port—For TCP/UDP attacks that have a fixed destination port
•
Side—Interface (Subscriber/Network) from which attack packets are sent
•
Attack-direction—If a single IP address is specified, the IP address is an attack-source or an
attack-destination address.
The system can identify a maximum of 1000 independent, simultaneous attacks.
Once an attack is identified, the system can be instructed to perform any of the following actions:
•
Report—
By default, the attack beginning and end are always reported.
•
Block—
The system will block all attack traffic for the duration of the attack. (The traffic is from or
to the attack IP address, depending on whether the IP address is an attack-source or
attack-destination)
•
Notify—
Subscriber notification. When the IP address identified is mapped to a particular subscriber
context, the system can be configured to notify the subscriber of the fact that he is under an attack
(or a machine in his network is generating such an attack), using HTTP Redirect.
•
Alarm—
The system will generate an SNMP trap each time an attack starts and stops.
Attack detection and handling are user-configurable. The remainder of this chapter explains how to
configure and monitor attack detection.
Attack Detection Thresholds
There are three thresholds that are used to define an attack. These thresholds are based on meters that
are maintained by the Cisco SCE platform for each IP address or pair of addresses, protocol, interface
and attack-direction.
•
open flow rate—
A flow for which some traffic was seen. Any packet seen for a new flow is enough
to declare this flow an open flow.
The rate is measured in new flows per second.
•
suspected flow rate—
A suspected flow is one that was opened, but did not become an established
flow.
The rate is measured in new flows per second.
•
suspected flow ratio—
The ratio of the suspected flow rate to the open flow rate.
As explained above, a specific-IP attack is declared if either of the following conditions is present:
•
The open flows rate exceeds the threshold
•
The suspected flows rate exceeds the threshold and the suspected flows ratio exceeds the threshold.
The values for each attack type will have a separate configured default value.
