SignaMax 065-7434, Руководство по настройке

Страница: 284 / 669

284 SIGNAMAX LLC • www.signamax.eu
data traffic detection. The detected attacks are limited. Often they are confined to some kinds
of denying service a ttacks or limited spoofing or hijacking actions.
For other kinds of attacks, such as, buffer overflow, password cracking, and even reserving
rights by utilizing Trojan horses or back doors, the system can only strengthen precautions
and reduce vulnerabilities by itself; the packet detection of network devices is helpless. The
detections added this time mainly aim at the DOS attacks:
Basic Commands
Command Description Config Mode
ip icmp intercept To detect and defend the icmp flood attack config
ip smurf intercept To detect and defend the smurf attack config
ip fraggle intercept To detect and defend the fraggle attack config
ip tcp intercept land To detect and defend the land attack config
ip tcp intercept list To detect and defend the syn flood attack config
The symbol “*” before the command description means that there is the configuration
example to describe the command in details later.
ip icmp intercept
ICMP flood
，
this kind of attack occupies bandwidth by sending a great deal of ICMP packets to
the target IP, which causes the legal packets cannot arrive the destination; When detecting,
count the number of the ICMP packets which are sent to the destination address (the address
of switch layer3 interface); once the receiving frequency of packets is higher than the normal
range, the attack may exist.
Strictly control the flowing frequency of packets until the frequency is lower than the range,
and then permit them to pass again. This dealing way has limitations: when refusing the
excessive packets, the legal packets are also refused. However, for comprehensive
consideration about the affordability of the system, this method is the most reasonable one.
The no format of the command is to cancel the detection.
ip icmp intercept list { access-list-number | access-list-name } [ maxcount ]
n
o ip icmp intercept list
{
access-list-number
|
access-list-name
} [
maxcount
]
Syntax Description
access-list-number The access list number, it can be a number among 1 to 1000.
access-list-name The name of the access list, which only supports the standard access list.