Fin-Flood Detect - H3C MSR Series Command Reference Manual

[Sysname-attack-defense-policy-atk-policy-1] fin-flood action drop
Related commands
client-verify tcp enable

fin-flood detect

fin-flood detect non-specific
fin-flood threshold
fin-flood detect
Use fin-flood detect to configure IP address-specific FIN flood attack detection.
Use undo fin-flood detect to remove the IP address-specific FIN flood attack detection
configuration.
Syntax
fin-flood detect { ip ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
[ threshold threshold-value ] [ action { { client-verify | drop | logging } * | none } ]
undo fin-flood detect { ip ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
Default
IP address-specific FIN flood attack detection is not configured.
Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
ip ipv4-address: Specifies the IPv4 address to be protected. The ipv4-address argument cannot be
255.255.255.255 or 0.0.0.0.
ipv6 ipv6-address: Specifies the IPv6 address to be protected.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN instance to which the protected IP
address belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters.
Do not specify this option if the protected IP address is on the public network.
threshold threshold-value: Specifies the threshold for triggering FIN flood attack prevention. The
value range is 1 to 1000000 in units of FIN packets sent to the specified IP address per second.
action: Specifies the actions when a FIN flood attack is detected. If no action is specified, the global
actions set by the fin-flood action command apply.
client-verify: Adds the victim IP addresses to the protected IP list for TCP client verification. If TCP
client verification is enabled, the device provides proxy services for protected servers.
drop: Drops subsequent FIN packets destined for the protected IP address.
logging: Enables logging for FIN flood attack events.
none: Takes no action.
Usage guidelines
With FIN flood attack detection configured for an IP address, the device is in attack detection state.
When the sending rate of FIN packets to the IP address reaches the threshold, the device enters
prevention state and takes the specified actions. When the rate is below the silence threshold
(three-fourths of the threshold), the device returns to the attack detection state.
1053