Defense Udp-Flood Rate-Threshold - HPE FlexNetwork HSR6800 Security Command Reference

packets destined for the specified IP address constantly reaches or exceeds the specified action
threshold, the device considers the IP address to be under attack, enters attack protection state, and
takes protection actions as configured.
low rate-number: Sets the silence threshold for UDP flood attack protection of the specified IP
address. The rate-number argument indicates the number of UDP packets sent to the specified IP
address per second and is in the range of 1 to 64000. The default value of the silence threshold is 3/4
of the action threshold. When the device is in attack protection state, if it detects that the sending rate
of UDP packets destined for the specified IP address drops below the silence threshold, it considers
that the attack is over, returns to attack detection state, and stops the protection measures.
Usage guidelines
You can configure UDP flood attack protection thresholds for a maximum of 32 IP addresses in each
attack protection policy.
Examples
# Configure UDP flood attack protection for IP address 192.168.1.2, and set the action threshold to
2000 packets per second and the silence threshold to 1000 packets per second.
<Sysname> system-view
[Sysname] attack-defense policy 1
[Sysname-attack-defense-policy-1] defense udp-flood ip 192.168.1.2 rate-threshold high
2000 low 1000
Related commands
•
defense udp-flood action drop-packet
•
defense udp-flood enable
•
display attack-defense policy

defense udp-flood rate-threshold

Use defense udp-flood rate-threshold to configure the global action and silence thresholds for
UDP flood attack protection. The device uses the global attack protection thresholds to protect the IP
addresses for which you do not configure attack protection parameters specifically.
Use undo defense udp-flood rate-threshold to restore the default.
Syntax
defense udp-flood rate-threshold high rate-number [ low rate-number ]
undo defense udp-flood rate-threshold
Default
The global action threshold is 1000 packets per second and the global silence threshold is 750
packets per second.
Views
Attack protection policy view
Default command level
2: System level
Parameters
high rate-number: Sets the global action threshold for UDP flood attack protection. The rate-number
argument indicates the number of UDP packets sent to an IP address per second and is in the range
of 1 to 64000. With the UDP flood attack protection enabled, the device enters attack detection state.
When the device detects that the sending rate of UDP packets destined for an IP address constantly
430