14.1 Overview to Attack Defense and Application Layer
Association
Attacks on TCP/IP networks increase steadily. Attacks to network devices may cause the
network to be disabled or unavailable.
14.1.1 Overview of Attack Defense and Application Layer
Association
Improving the capability of the device to defense DoS attacks, scan and probe attacks, malformed
packet attacks can enhance the system security and meet the demands of service deployment.
TCP/IP Attack Defense
The attacks on the TCP/IP network keep increasing because the TCP/IP protocols have defects
and loose implementation. As a result, the impact on the TCP/IP network is greater and greater.
Especially the attacks on the network devices may lead to network failure.
The attacks on the TCP/IP network are classified into three types: denial of service (DoS) attacks,
scanning attacks, and abnormal packet attacks.
l
DoS attack
DoS attackers send so massive packets to the system that the system cannot process normal
requests or the resources are exhausted. DoS attackers use SYN flood or fraggle methods
to attack the system.
DoS attacks are different from other attacks because DoS attackers does not search for the
ingress of a network but prevents valid users from accessing resources or Router .
l
Scanning attack
Scanning attacks identify the systems running on the network through ping scanning (ICMP
and TCP) and thus accurately obtain the potential victims. TCP and UDP port scanning can
be used to detect the type of operating system and potential services.
Through scanning, the attacker can learn the service types provided by the target system
and the latent security loopholes, thus getting ready to attack the system.
l
Abnormal packet attack
Abnormal packet attacks use abnormal packets. That is, the attacker sends defective IP
packets to the target system, and the target system may crash when processing such IP
packets. Main abnormal packet attacks include Ping of Death and Teardrop.
Router are used in a large number on core networks and MANs. You can enhance the system
security to meet the service requirements by enhancing the attack defense performance of
Router .
Application Layer Association
Router s may simultaneously use multiple services or functions, including Layer 2 services (STP,
MSTP, and RRPP), route services (OSPF and BGP), MPLS services (LDP and RSVP), system
services (FTP Server and TFTP Server), and diagnosis functions (Ping and Tracert).
In this case, attackers can send packets of different types to attack Router s. If the sent packets
are multicast packets or the destination address is the address of a port (including the loopback
Huawei AR1200-S Series Enterprise Routers
Configuration Guide - Security
14 Configuration of Attack Defense and Application Layer
Association
Issue 02 (2012-03-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
281