Chapter 24 Dos Attack Prevention Command List - D-Link DGS-1510/ME Series Reference Manual

Chapter 24 DoS Attack Prevention Command
config dos_prevention dos_type [{land_attack | blat_attack | tcp_null_scan | tcp_xmasscan | tcp_synfin |
tcp_syn_srcport_less_1024 | ping_death_attack | tcp_tiny_frag_attack} | all] {action [drop] | state [enable |
disable]}
show dos_prevention {land_attack | blat_attack | tcp_null_scan | tcp_xmasscan | tcp_synfin |
tcp_syn_srcport_less_1024 | ping_death_attack | tcp_tiny_frag_attack}
config dos_prevention trap [enable | disable]
config dos_prevention log [enable | disable]
24-1 config dos_prevention dos_type
Description
This command is used to configure the prevention of each Denial-of-Service (DoS) attack, including state and
action. The packet matching will be done by hardware. For a specific type of attack, the content of the packet will
be matched against a specific pattern.
Format
config dos_prevention dos_type [{land_attack | blat_attack | tcp_null_scan | tcp_xmasscan | tcp_synfin |
tcp_syn_srcport_less_1024 | ping_death_attack | tcp_tiny_frag_attack} | all] {action [drop] | state [enable |
disable]}
Parameters
land_attack - (Optional) Specifies to check whether the source address is equal to destination address of a
received IP packet.
blat_attack - (Optional) Specifies to check whether the source port is equal to destination port of a received TCP
packet.
tcp_null_scan - (Optional) Specifies to check whether a received TCP packet contains a sequence number of 0
and no flags.
tcp_xmasscan - (Optional) Specifies to check whether a received TCP packet contains URG, Push and FIN
flags.
tcp_synfin - (Optional) Specifies to check whether a received TCP packet contains FIN and SYN flags.
tcp_syn_srcport_less_1024 - (Optional) Specifies to check whether the TCP packets source ports are less than
1024 packets.
ping_death_attack - (Optional) Specifies to detect whether received packets are fragmented ICMP packets.
tcp_tiny_frag_attack - (Optional) Specifies to check whether the packets are TCP tiny fragment packets.
all - Specifies all DoS attack type.
action - (Optional) Specifies to take the following action when enabling DoS prevention.
drop - Specifies to drop DoS attack packets.
state - (Optional) Specifies the DoS attack prevention state.
enable - Specifies to enable DoS attack prevention.
disable - Specifies to disable DoS attack prevention.
DGS-1510/ME Series Metro Ethernet Switch CLI Reference Guide
List
212