HP A6600 Configuration Manual page 405

Configuring a single-packet attack protection policy
The single-packet attack protection function determines whether a packet is an attack packet mainly by
analyzing the characteristics of the packet. It is usually applied to interfaces connecting external
networks and inspects only the inbound packets of the interfaces. If detecting an attack packet, the
device outputs an alarm log by default and, depending on your configuration, drops or forwards the
packet.
To configure a policy for preventing single-packet attacks:
To do...
1. Enter system view.
2. Enter attack protection policy
view.
3. Enable signature detection for
single-packet attacks.
4. Configure the ICMP packet
length threshold that triggers
large ICMP attack protection.
5. Configure the device to drop
single-packet attack packets.
Configuring a scanning attack protection policy
The scanning attack protection function detects scanning attacks by monitoring the establishment rate of
connections to the target systems. It is usually applied to interfaces connecting external networks and
inspects only the inbound packets of the interfaces. If the device detects that the rate at which an IP
address initiates connections reaches or exceeds the predefined threshold, the device outputs alarm logs,
drops subsequent packets received from the IP address, and, depending on your configuration, adds the
IP address to the blacklist.
To configure a policy for preventing scanning attacks:
To do...
1. Enter system view.
2. Enter attack protection policy view.
3. Enable scanning attack protection.
4. Specify the connection rate
threshold that triggers scanning
attack protection.
5. Configure
the
blacklist
Command...
system-view
attack-defense policy policy-
number
signature-detect { fraggle | icmp-
redirect | icmp-unreachable |
land | large-icmp | route-record
| smurf | source-route | tcp-flag
| tracert | winnuke } enable
signature-detect large-icmp max-
length length
signature-detect action drop-
packet
Enable the blacklist
function for scanning
attack protection.
Command...
system-view
attack-defense policy
policy-number
defense scan enable
defense scan max-rate
rate-number
defense scan add-to-
blacklist
393
Remarks
—
—
Required.
By default, signature detection
is disabled for all kinds of
single-packet attacks.
Optional.
4000 bytes by default.
Optional.
By default, the device only
outputs alarm logs if detecting a
single-packet attack.
Remarks
—
—
Required.
Disabled by default.
Optional.
4000 connections per second by
default.
Optional.
Disabled by default.