5000 Series Layer 2/3 Managed Data Center Switch CLI Reference Guide
547
Example
The following shows example CLI display output for the command.
(Routing)#show lldp med remote-device detail 0/8
LLDP MED Remote Device Detail
Local Interface: 0/42
Remote Identifier: 8
Capabilities
MED Capabilities Supported:
MED Capabilities Enabled:
Network Policies
Denial of Service Commands
This section describes the commands you use to configure Denial of Service (DoS) Control. D-LINK OS
software provides support for classifying and blocking specific types of Denial of Service attacks. You can
configure your system to monitor and block these types of attacks:
•
SIP = DIP:
Source IP address = Destination IP address.
•
First Fragment:
TCP Header size smaller then configured value.
•
TCP Fragment:
Allows the device to drop packets that have a TCP payload where the IP
payload length minus the IP header size is less than the minimum allowed TCP header size.
•
TCP Flag:
TCP Flag SYN set and Source Port < 1024 or TCP Control Flags = 0 and TCP
Sequence Number = 0 or TCP Flags FIN, URG, and PSH set and TCP Sequence Number = 0 or
TCP Flags SYN and FIN set.
•
L4 Port:
Source TCP/UDP Port = Destination TCP/UDP Port.
•
ICMP:
Limiting the size of ICMP Ping packets.
•
SMAC = DMAC:
Source MAC address = Destination MAC address.
•
TCP Port:
Source TCP Port = Destination TCP Port.
•
UDP Port:
Source UDP Port = Destination UDP Port.
•
TCP Flag & Sequence:
TCP Flag SYN set and Source Port < 1024 or TCP Control Flags = 0
and TCP Sequence Number = 0 or TCP Flags FIN, URG, and PSH set and TCP Sequence
Number = 0 or TCP Flags SYN and FIN set.
•
TCP Offset:
Allows the device to drop packets that have a TCP header Offset set to 1.
•
TCP SYN:
TCP Flag SYN set.
•
TCP SYN &. FIN:
TCP Flags SYN and FIN set.
•
TCP FIN & URG & PSH:
TCP Flags FIN and URG and PSH set and TCP Sequence Number = 0.
•
ICMP V6:
Limiting the size of ICMPv6 Ping packets.
•
ICMP Fragment:
Checks for fragmented ICMP packets.
5-548 dos-control all
This command enables Denial of Service protection checks globally.
Use the
no
command to disable Denial of Service prevention checks globally.
Содержание 5000 Series
Страница 1: ...Draft 1 2 1 ...
Страница 141: ...5000 Series Layer 2 3 Managed Data Center Switch CLI Reference Guide 135 ...