How To Disable All Attack Detectors; Sample Attack Detector Configuration - Cisco SCE8000 Configuration Manual

Configuring Attack Detectors

How to Disable All Attack Detectors

Use the following command to disable all attack detectors, configuring them to use the default values.
Step 1 From the SCE(config if)# prompt, type default attack-detector all and press Enter.
Disables all attack detectors.

Sample Attack Detector Configuration

The following configuration changes the default user threshold values used for detecting ICMP attacks,
and configures an attack-detector with high thresholds for UDP attacks, preventing false detections of
two DNS servers (10.1.1.10 and 10.1.1.13) as being attacked.
From the SCE(config)# prompt, type interface linecard 0 and press Enter.
Step 1
Enters linecard interface configuration mode
From the SCE(config if)# prompt, type attack-detector default protocol ICMP attack-direction
Step 2
single-side-source
suspected-flows-ratio
Configures the default ICMP threshold and action.
From the SCE(config if)# prompt, type attack-detector
Step 3
press Enter.
Enables attack detector #1 and assigns ACL #3 to it.
From the SCE(config if)# prompt, type attack-detector
Step 4
Defines the list of UDP destination ports for attack detector #1 with one port, port 53
From the SCE(config if)# prompt, type attack-detector 1 protocol UDP dest-port specific
Step 5
attack-direction
suspected-flows-rate
Defines the thresholds and action for attack detector #1.
From the SCE(config if)# prompt, type attack-detector 1 protocol UDP dest-port specific
Step 6
attack-direction
Enables subscriber notification for attack detector #1.
From the SCE(config if)# prompt, type exit and press Enter.
Step 7
Exits the linecard interface configuration mode.
Configure ACL #3, which has been assigned to the attack detector.
Step 8
SCE(config)# access-list 3 permit 10.1.1.10
SCE(config)# access-list 3 permit 10.1.1.13
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
10-16
Chapter 10
side action
both report
and press Enter.
10
single-side-destination
and press Enter.
1000000
single-side-destination
Identifying and Preventing Distributed-Denial-Of-Service Attacks
open-flow-rate suspected-flows-rate
1000
access-list
1 3
UDP-ports-list
1
side action
both report
side
subscriber notify-subscriber
100
comment
"DNS servers"
53
open-flow-rate
1000000
and press Enter.
OL-16479-01
and