Scan Detect - HP FlexNetwork MSR Series Command Reference Manual

Examples
# Set the global threshold to 100 for triggering RST flood attack prevention in the attack defense
policy atk-policy-1.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] rst-flood threshold 100
Related commands
rst-flood action
rst-flood detect
rst-flood detect non-specific

scan detect

Use scan detect to configure scanning attack detection.
Use undo scan detect to remove the scanning attack detection configuration.
Syntax
scan detect level { high | low | medium } action { { block-source [ timeout minutes ] | drop } |
logging } *
undo scan detect level { high | low | medium }
Default
Scanning attack detection is disabled.
Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
level: Specifies the level of the scanning attack detection.
low: Specifies the low level. This level provides basic scanning attack detection. It has a low false
alarm rate but many scanning attacks cannot be detected. Statistics are collected every 60 seconds
for the low level detection.
high: Specifies the high level. This level can detect most of the scanning attacks, but has a high false
alarm rate. Some packets from active hosts might be considered as attack packets. Statistics are
collected every 600 seconds for the high level detection.
medium: Specifies the medium level. Compared with the high and low levels, this level has medium
false alarm rate and attack detection accuracy. Statistics are collected every 90 seconds for the
medium level detection.
action: Specifies the actions against scanning attacks.
block-source: Adds the attackers' IP addresses to the IP blacklist. If the blacklist feature is enabled
on the receiving interface, the device drops subsequent packets from the blacklisted IP addresses.
timeout minutes: Specifies the aging timer in minutes for the dynamically added blacklist entries, in
the range of 1 to 1000. The default aging timer is 10 minutes.
drop: Drops subsequent packets from detected scanning attack sources.
logging: Enables logging for scanning attack events.
909