Anti-Attack System Guard Configuration; Overview - D-Link xStack DGS-3610 Series Configuration Manual

DGS-3610 Series Configuration Guide
41

41.1 Overview

It is known that many attacks of hackers and invasion of network virus start with scanning
the active hosts in the network. The great amount of scanning packet consumes network
bandwidth significantly and causes abnormal operation of the network communication.
DGS-3610 series provide the anti-scanning function to prevent hacker scanning and the
Worm.Blaster-like attacks, and reduce the CPU load of the layer 3 devices.
At present, two types of scanning attacks are detected:
1. The scanning of the change for the destination IP address is called the Scan Dest Ip
Attack. This scanning is the most serious threat to the network for it consumes the
network bandwidth and adds the load of the devices, so it becomes the primary means
of most hacker attacks.
2. The destination IP address does not exist, while a large number of packets are sent
continuously, which is referred to as the Same Dest Ip Attack.This attack is mainly
designed to reduce the load of the CPU for the devices. For the layer 3 switches, if the
destination IP address exists, the packet will be forwarded directly by the switching chip
and does not occupy the resource of the CPU for the switches. If the destination IP
address does not exist, the CPU of the devices will attempt to connect periodically.
Furthermore, if there are a large number of such attacks, they will consume the CPU
resource. Of course, the hazard of this attack is much weaker than the first one.
For the above two kinds of attacks, it is possible to adjust the attack threshold, attack host
isolation duration and more parameters on the interfaces of DGS-3610 series, to relieve the
burden of the network or devices. The administrator can tune the administration
configuration of the device according to the network conditions. If the configuration of each
interface is identical, the administrator can set a batch of ports through the interface range
function.
Anti-attack System Guard
Configuration
Chapter 41 Anti-attack System Guard Configuration
41-1