SignaMax SC30010, Справочное руководство CLI

Страница: 310 / 671

Chapter 9
| General Security Measures
Denial of Service Protection
– 310 –
dos-protection
udp-flooding
This command protects against DoS UDP-flooding attacks in which a
perpetrator sends a large number of UDP packets (with or without a spoofed-
Source IP) to random ports on a remote host. The target will determine that
application is listening at that port, and reply with an ICMP Destination
Unreachable packet. It will be forced to send many ICMP packets, eventually
leading it to be unreachable by other clients. Use the
no form without the bit
rate parameter to disable this feature, or with the bit rate parameter to restore
the default rate limit.
Syntax
[ no ] dos-protection udp-flooding [ bit-rate-in-kilo rate ]
rate – Maximum allowed rate. (Range: 64-2000 kbits/second)
Default Setting
Disabled, 1000 kbits/second
Command Mode
Global Configuration
Example
Console(config)#dos-protection udp-flooding bit-rate-in-kilo 65
Console(config)#
dos-protection
win-nuke
This command protects against DoS WinNuke attacks in which affected the
Microsoft Windows 3.1x/95/NT operating systems. In this type of attack, the
perpetrator sends the string of OOB out-of-band (OOB) packets contained a
TCP URG flag to the target computer on TCP port 139 (NetBIOS), casing it to
lock up and display a “Blue Screen of Death.” This did not cause any damage
to, or change data on, the computer’s hard disk, but any unsaved data would
be lost. Microsoft made patches to prevent the WinNuke attack, but the OOB
packets still put the service in a tight loop that consumed all available CPU
time. Use the
no form without the bit rate parameter to disable this feature, or
with the bit rate parameter to restore the default rate limit.
Syntax
[ no ] dos-protection win-nuke [ bit-rate-in-kilo rate ]
rate – Maximum allowed rate. (Range: 64-2000 kbits/second)
Default Setting
Disabled, 1000 kbits/second
Command Mode
Global Configuration