Defense Scan Max-Rate - HP HSR6600 Command Reference Manual

Default command level
2: System level
Usage guidelines
With scanning attack protection enabled, a device checks the connection rate by IP address. If the
connection rate of an IP address reaches or exceeds the threshold (set by the defense scan max-rate
command), the device considers the IP address a scanning attack source and drops subsequent packets
from the IP address until it finds that the rate is less than the threshold.
Examples
# Enable scanning attack protection.
<Sysname> system-view
[Sysname] attack-defense policy 1
[Sysname-attack-defense-policy-1] defense scan enable
Related commands
blacklist enable
•
• defense scan add-to-blacklist
defense scan blacklist-timeout
•

defense scan max-rate

•
defense scan max-rate
Use defense scan max-rate to specify the threshold of connection establishment rate that triggers
scanning attack prevention.
Use undo defense scan max-rate to restore the default, which is 4000 connections per second.
Syntax
defense scan max-rate rate-number
undo defense scan max-rate
Views
Attack protection policy view
Default command level
2: System level
Parameters
rate-number: Threshold of the connection establishment rate (number of connections established in a
second) that triggers scanning attack protection, in the range of 1 to 10000.
Usage guidelines
With scanning attack protection enabled, a device checks the connection rate by IP address. If the
connection rate of an IP address reaches or exceeds the threshold, the device considers the IP address a
scanning attack source and drops subsequent packets from the IP address until it finds that the rate is less
than the threshold.
Examples
# Enable scanning attack protection.
<Sysname> system-view
466