Fin-Flood Detect Non-Specific - HP MSR Series Command Reference Manual

Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
ip ip-address: Specifies the IPv4 address to be protected. The ip-address argument cannot be all 1s or 0s.
ipv6 ipv6-address: Specifies the IPv6 address to be protected. The ipv6-address argument cannot be a
multicast address or all 0s.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN instance to which the protected IP address
belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. Do not specify
this option if the protected IP address is on the public network.
threshold threshold-value: Sets the threshold for triggering FIN flood attack prevention. The value range
is 1 to 1000000 in units of FIN packets sent to the specified IP address per second.
action: Specifies the actions when a FIN flood attack is detected. If no action is specified, the global
actions set by the fin-flood action command apply.
client-verify: Adds the victim IP addresses to the protected IP list for TCP client verification. If TCP client
verification is enabled, the device provides proxy services for protected servers.
drop: Drops subsequent FIN packets destined for the protected IP address.
logging: Enables logging for FIN flood attack events. The log information records the detection interface,
victim IP address, MPLS L3VPN instance name, current packet statistics, prevention action, and start time
of the attack.
Usage guidelines
You can configure FIN flood attack detection for multiple IP addresses in one attack defense policy.
With FIN flood attack detection configured, the device is in attack detection state. An attack occurs when
the device detects that the sending rate of FIN packets to a protected IP address reaches or exceeds the
threshold. The device enters prevention state and takes actions to protect the target IP address. When the
rate is below the silence threshold (three-fourths of the threshold), the device considers that the threat is
over and returns to the attack detection state.
Examples
# Configure FIN flood attack detection for 192.168.1.2 in attack defense policy atk-policy-1.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] fin-flood detect ip 192.168.1.2 threshold
2000
Related commands
fin-flood action
•

fin-flood detect non-specific

•
• fin-flood threshold
fin-flood detect non-specific
Use fin-flood detect non-specific to enable FIN flood attack detection for non-specific IP addresses.
620