Alcatel-Lucent OmniSwitch 6850-48 Network Configuration Manual page 512

IP Configuration
In the next minute, 10 more TCP and UDP closed port packets are received, along with 200 UDP open-
port packets. This would bring the total penalty value to 4300, as shown using the following equation:
(100 previous minute value) + (10 TCP X 10 penalty) + (10 UDP X 10 penalty) +
(200 UDP X 20 penalty) = 4300
This value would be divided by 2 (due to decay) and decreased to 2150. The switch would record a port
scan and generate a trap to warn the administrator:
10 TCP closed port packets
10 UDP closed port packets
100 UDP open port packets
The above functions and how to set their values are covered in the sections that follow.
Setting Penalty Values
There are three types of traffic you can set a penalty value for:
•
TCP/UDP packets bound for closed ports.
•
TCP traffic bound for open ports.
•
UDP traffic bound for open ports.
Each type has its own command to assign a penalty value. Penalty values can be any non-negative integer.
Each time a packet is received that matches an assigned penalty, the total penalty value for the switch is
increased by the penalty value of the packet in question.
To assign a penalty value to TCP/UDP packets bound for a closed port, use the
penalty command with a penalty value. For example, to assign a penalty value of 10 to TCP/UDP packets
destined for closed ports, enter the following:
-> ip dos scan close-port-penalty 10
To assign a penalty value to TCP packets bound for an open port, use the
penalty command with a penalty value. For example, to assign a penalty value of 10 to TCP packets
destined for opened ports, enter the following:
-> ip dos scan tcp open-port-penalty 10
To assign a penalty value to UDP packets bound for an open port, use the
penalty command with a penalty value. For example, to assign a penalty value of 10 to TCP/UDP packets
destined for closed ports, enter the following:
-> ip dos scan udp open-port-penalty 10
page 24-26
DoS Settings
UDP/TCP closed = 10
UDP open =20
TCP open = 5
Threshold = 2000
Decay = 2
Minute 2 Penalty Total = 2150
OmniSwitch AOS Release 6 Network Configuration Guide
Configuring IP
Generate DoS
Attack Warning
Trap
ip dos scan close-port-
ip dos scan tcp open-port-
ip dos scan udp open-port-
September 2009