Arp Throttling - Cisco 7604 Configuration Manual

Chapter 36 Configuring Denial of Service Protection
Router(config)# mls rate-limit unicast cef receive 1000 <====== Note: traffic rate limited to 1000 pps
Router(config)# end
Router#
1w6d: %SYS-5-CONFIG_I: Configured from console by console
Router#
1w6d: %OSPF-5-ADJCHG: Process 100, Nbr 6.6.6.122 on Vlan46 from LOADING to FULL, Loading Done
Router# show ip eigrp neighbors
IP-EIGRP neighbors for process 200
H Address
0 4.4.4.122
Router#
Traffic Storm Control
A traffic storm occurs when packets flood the LAN, which creates excessive traffic and degrades
network performance. The traffic storm control feature prevents LAN ports from being disrupted by a
broadcast, multicast, or unicast traffic storm on physical interfaces from either mistakes in network
configurations or from users issuing a DoS attack. Traffic storm control (also called traffic suppression)
monitors incoming traffic levels over a 1-second traffic storm control interval. During the interval, traffic
storm control compares the traffic level with the configured traffic storm control level. The traffic storm
control level is a percentage of the total available bandwidth of the port. Each port has a single traffic
storm control level that is used for all types of traffic (broadcast, multicast, and unicast).
Traffic storm control is configured on an interface and is disabled by default. The configuration example
here enables broadcast address storm control on interface FastEthernet 2/3 to a level of 20 percent. When
the broadcast traffic exceeds the configured level of 20 percent of the total available bandwidth of the
port within a 1-second traffic-storm-control interval, traffic storm control will drop all broadcast traffic
until the end of the traffic-storm-control interval.
Router(config-if)# storm-control broadcast level 20
The Cisco 7600 series router supports broadcast storm control on all LAN ports and multicast and
unicast storm control on Gigabit Ethernet ports.
When two or three suppression modes are configured simultaneously, they share the same level settings.
If broadcast suppression is enabled, and if multicast suppression is also enabled and configured at a
70-percent threshold, the broadcast suppression will also have a setting for 70 percent.
For more information about configuring traffic storm control see
Control."

ARP Throttling

ARP throttling can be used to automatically install hardware-based FIB and adjacency entries to drop packets
during ARP resolution. Most of these packets are dropped, but a small number are sent to the MSFC (rate
limited).
uRPF Check
When you enable the unicast reverse path forwarding (uRPF) check, packets that lack a verifiable source
IP address, such as spoofed IP source addresses, are discarded. Cisco Express Forwarding (CEF) tables
are used to verify that the source addresses and the interfaces on which they were received are consistent
with the FIB tables on the supervisor engine.
OL-4266-08
Interface Hold Uptime
(sec)
Vl44 12 00:00:07
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
Understanding How DoS Protection Works
SRTT RTO Q Seq Type
(ms) Cnt Num
12 200 0 6536
Chapter 39, "Configuring Traffic Storm
36-5