Syn-Flood Threshold - HP FlexNetwork MSR Series Command Reference Manual

syn-flood threshold

Use syn-flood threshold to set the global threshold for triggering SYN flood attack prevention.
Use undo syn-flood threshold to restore the default.
Syntax
syn-flood threshold threshold-value
undo syn-flood threshold
Default
The global threshold is 1000 for triggering SYN flood attack prevention.
Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
threshold-value: Specifies the threshold value. The value range is 1 to 1000000 in units of SYN
packets sent to an IP address per second.
Usage guidelines
The global threshold applies to global SYN flood attack detection. Adjust the threshold according to
the application scenarios. If the number of SYN packets sent to a protected server, such as an HTTP
or FTP server, is normally large, set a large threshold. A small threshold might affect the server
services. For a network that is unstable or susceptible to attacks, set a small threshold.
With global SYN flood attack detection configured, the device is in attack detection state. When the
sending rate of SYN packets to an IP address reaches the threshold, the device enters prevention
state and takes the specified actions. When the rate is below the silence threshold (three-fourths of
the threshold), the device returns to the attack detection state.
Examples
# Set the global threshold to 100 for triggering SYN flood attack prevention in the attack defense
policy atk-policy-1.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] syn-flood threshold 100
Related commands
syn-flood action
syn-flood detect
syn-flood detect non-specific
udp-flood action
Use udp-flood action to specify global actions against UDP flood attacks.
Use undo udp-flood action to restore the default.
Syntax
udp-flood action { drop | logging } *
undo udp-flood action
922