Directions; Configuring The Default Attack Detector; Options; How To Define The Default Action And Optionally The Default Thresholds - Cisco SCE8000 Configuration Manual

Configuring Attack Detectors
How to Disable Specific-IP Detection for Protocols Other than TCP, UDP, and ICMP for all Attack

Directions

Step 1 From the SCE(config if)# prompt, type no attack-filter protocol other and press Enter.
How to Disable Specific-IP Detection for ICMP for Single-sided Attacks Defined by the Source IP
Step 1 From the SCE(config if)# prompt, type no attack-filter protocol ICMP attack-direction
single-side-source and press Enter.

Configuring the Default Attack Detector

•
•
•
•
Use these commands to configure the values for the default attack detector for the following parameters:
•
•
•
•
If a specific attack detector is defined for a particular attack type, it will override the configured default
attack detector.

Options

The following options are available:
•
•
•
•
•
•
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
10-10
Options, page 10-10
How to Define the Default Action and Optionally the Default Thresholds, page 10-11
How to Reinstate the System Defaults for a Selected Set of Attack Types, page 10-12
How to Reinstate the System Defaults for All Attack Types, page 10-12
Attack handling action
Thresholds
Subscriber notification
Sending an SNMP trap
attack-detector — The attack detector being configured; in this case, the default attack detector.
protocol — Defines the protocol to which the default attack detector applies.
attack-direction — Defines whether the default attack detector applies to single sided or dual sided
attacks.
destination port {TCP and UDP protocols only) — Defines whether the default attack detector
applies to port-based or port-less detections.
side — Defines whether the default attack detector applies to attacks originating at the subscriber
or network side.
action — Default action:
report (default) — Report beginning and end of the attack by writing to the attack-log.
–
block — Block all further flows that are part of this attack, the SCE platform drops the packets.
–
Chapter 10 Identifying and Preventing Distributed-Denial-Of-Service Attacks
OL-16479-01