HP HSR6600 Command Reference Manual page 477

Syntax
defense scan add-to-blacklist
undo defense scan add-to-blacklist
Default
The blacklist function for scanning attack protection is not enabled.
Views
Attack protection policy view
Default command level
2: System level
Usage guidelines
With scanning attack protection enabled, a device checks the connection rate by IP address. If the
connection rate of an IP address reaches or exceeds the threshold (set by the defense scan max-rate
command), the device considers the IP address a scanning attack source and drops subsequent packets
from the IP address until it finds that the rate is less than the threshold. At the same time, if the blacklist
function for scanning attack protection is also enabled, the device adds the source IP address to the
blacklist, which then filters packets until the blacklist entry is aged out (the aging time is set by the defense
scan blacklist-timeout command).
The blacklist entries added by the scanning attack protection function take effect only after you enable
the blacklist function for the device by using the blacklist enable command.
If you delete an entry blacklisted by scanning attack protection short after the entry is added (within 1
second), the system does not add the entry again. This is because the system considers the subsequent
packets matching the entry the packets of the same attack.
Examples
# Enable scanning attack protection.
<Sysname> system-view
[Sysname] attack-defense policy 1
[Sysname-attack-defense-policy-1] defense scan enable
# Set the connection rate threshold for triggering scanning attack protection to 2000 connections per
second.
[Sysname-attack-defense-policy-1] defense scan max-rate 2000
# Enable the blacklist function for scanning attack protection, and specify the blacklist entry aging time
as 20 minutes.
[Sysname-attack-defense-policy-1] defense scan add-to-blacklist
[Sysname-attack-defense-policy-1] defense scan blacklist-timeout 20
[Sysname-attack-defense-policy-1] quit
# Enable the blacklist function globally to make the blacklist function for scanning attack protection take
effect.
[Sysname] blacklist enable
Related commands
blacklist enable
•
defense scan blacklist-timeout
•
• defense scan enable
464