Fin-Flood Detect Non-Specific - HP FlexNetwork MSR Series Command Reference Manual

threshold threshold-value: Specifies the threshold for triggering FIN flood attack prevention. The
value range is 1 to 1000000 in units of FIN packets sent to the specified IP address per second.
action: Specifies the actions when a FIN flood attack is detected. If no action is specified, the global
actions set by the fin-flood action command apply.
client-verify: Adds the victim IP addresses to the protected IP list for TCP client verification. If TCP
client verification is enabled, the device provides proxy services for protected servers.
drop: Drops subsequent FIN packets destined for the protected IP address.
logging: Enables logging for FIN flood attack events.
none: Takes no action.
Usage guidelines
With FIN flood attack detection configured for an IP address, the device is in attack detection state.
When the sending rate of FIN packets to the IP address reaches the threshold, the device enters
prevention state and takes the specified actions. When the rate is below the silence threshold
(three-fourths of the threshold), the device returns to the attack detection state.
Examples
# Configure FIN flood attack detection for 192.168.1.2 in the attack defense policy atk-policy-1.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] fin-flood detect ip 192.168.1.2 threshold
2000
Related commands
fin-flood action

fin-flood detect non-specific

fin-flood threshold
fin-flood detect non-specific
Use fin-flood detect non-specific to enable global FIN flood attack detection.
Use undo fin-flood detect non-specific to disable global FIN flood attack detection.
Syntax
fin-flood detect non-specific
undo fin-flood detect non-specific
Default
Global FIN flood attack detection is disabled.
Views
Attack defense policy view
Predefined user roles
network-admin
Usage guidelines
The global FIN flood attack detection applies to all IP addresses except for those specified by the
fin-flood detect command. The global detection uses the global trigger threshold set by the
fin-flood threshold command and global actions specified by the fin-flood action command.
889