Defense Syn-Flood Rate-Threshold - HP HSR6600 Command Reference Manual

high rate-number: Sets the action threshold for SYN flood attack protection of the specified IP address.
The rate-number argument indicates the number of SYN packets sent to the specified IP address per
second and is in the range of 1 to 64000. With SYN flood attack protection enabled, the device enters
attack detection state. When the device detects that the sending rate of SYN packets destined for the
specified IP address constantly reaches or exceeds the specified action threshold, the device considers
the IP address to be under attack, enters attack protection state, and takes protection actions as
configured.
low rate-number: Sets the silence threshold for SYN flood attack protection of the specified IP address.
The rate-number argument indicates the number of SYN packets sent to the specified IP address per
second and is in the range of 1 to 64000. The default value of the silence threshold is 3/4 of the action
threshold. When the device is in attack protection state, if it detects that the sending rate of SYN packets
destined for the specified IP address drops below the silence threshold, it considers that the attack is over,
returns to attack detection state, and stops taking the protection measures.
Usage guidelines
You can specify a maximum of 32 protected IP addresses in each attack protection policy.
Examples
# Configure SYN flood attack protection for IP address 192.168.1.2, and set the action threshold to 2000
packets per second and the silence threshold to 1000 packets per second.
<Sysname> system-view
[Sysname] attack-defense policy 1
[Sysname-attack-defense-policy-1] defense syn-flood ip 192.168.1.2 rate-threshold high
2000 low 1000
Related commands
defense syn-flood action
•
• defense syn-flood enable
display attack-defense policy
•

defense syn-flood rate-threshold

Use defense syn-flood rate-threshold to configure the global action and silence thresholds for SYN flood
attack protection. The device uses the global attack protection thresholds to protect the IP addresses for
which you do not configure attack protection parameters specifically.
Use undo defense syn-flood rate-threshold to restore the default.
Syntax
defense syn-flood rate-threshold high rate-number [ low rate-number ]
undo defense syn-flood rate-threshold
Default
The global action threshold is 1000 packets per second and the global silence threshold is 750 packets
per second.
Views
Attack protection policy view
Default command level
2: System level
469