SignaMax 065-7434, Руководство по настройке

Страница: 285 / 669

285 SIGNAMAX LLC • www.signamax.eu
maxcount To set the threshold value for detection (by default: 500); if the number of
the ICMP packets sent to the host received in 1 second exceeds number,
then intercept.
ip smurf intercept
Smurf is also such kind of attack. The attacker at first use the address of the victim host to
send the ICMP responding request to a broadcast address; in the broadcast network,
thousands of potential computers will response and a great deal of responses will be sent to
the victim host. The consequence of the attack is the same as that of the ICMP flood, but this
one is more secrete.
This kind of packets can be intercept by two ways. If the Pseudo-source address detection can
detect the attack, the packets are refused directly. In addition, users can enable the smurf
detection switch, if the source address is a protected destination server address, but the
destination address is a broadcast address, then intercept this kind of packets; smurf uses the
ICMP_ECHO packet to detect, however consider about other ICMP requesting packets may
cause the same consequence, the detection types are extended to ICMP_TSTAMP
、
ICMP_IREQ
、
ICMP_MASKREQ;
no ip smurf intercept list { access-list-number | access-list-name } [ masklen { number } ]
ip smurf intercept list
{
access-list-number
|
access-list-name
} [
masklen
{
number
} ]
Syntax Description
access-list-number The access list number, it can be a number among 1 to 1000
access-list-name The name of the access list, which only supports the standard access list
masklen The length of the destination network mask (by default:24)
ip fraggle intercept
The fraggle attack is a variety of the smurf. On the premise that many firewalls detect ICMP
packets strictly, it doesn’t send the ICMP requesting packets to the broadcast address but
sends the UDP packets. When the computer of the destination network segment receives the
packets and detects that the destination port is unreachable, it sends an error packet
“destination port is unreachable” to the victim host, then a great deal of packets rush to the
victim host at the same time. In this way, the goal for attacking is achieved; this kind of
detection is similar with smurf, only the types are different.
no ip fraggle intercept list { access-list-number | access-list-name } [ masklen { number } ]
ip fraggle intercept list { access-list-number | access-list-name } [ masklen { number } ]
Syntax Description
access-list-number The access list number, it can be a number among 1 to 1000
access-list-name The name of the access list, which only supports standard access list