C H A P T E R 12 Identifying And Preventing Distributed Denial-Of-Service Attacks - Cisco SCE 8000 10GBE Software Configuration Manual

Attack Filtering and Attack Detection
Attack Filtering and Attack Detection
•
•
•
•
•
•
Attack Filtering
The Cisco SCE platform includes extensive capabilities for identifying DDoS attacks, and protecting
against them.
Attack filtering is performed using specific-IP attack detectors. A specific-IP attack detector tracks the
rate of flows (total open and total suspected) in the Cisco SCE platform for each combination of IP
address (or pair of IP addresses), protocol (TCP/UDP/ICMP/Other), destination port (for TCP/UDP),
interface and direction. When the rates satisfy user-configured criteria, it is considered an attack, and a
configured action can take place (report/block, notify subscriber, send SNMP trap).
This mechanism is enabled by default, and can be disabled and enabled for each attack type
independently.
There are 32 different attack types:
•
•
•
•
•
•
•
•
•
Specific Attack Filtering
When the specific IP attack filter is enabled for a certain attack type, two rates are measured per defined
entity:
•
•
Cisco SCE 8000 10GBE Software Configuration Guide
12-2
Attack Filtering, page 12-2
Specific Attack Filtering, page 12-2
Attack Detection, page 12-4
Attack Detection Thresholds, page 12-4
Attack Handling, page 12-5
Hardware Filtering, page 12-6
1—TCP flows from a specific IP address on the subscriber side, regardless of destination port
2—TCP flows to a specific IP address on the subscriber side, regardless of destination port
3-4—Same as 1 and 2, but for the opposite direction (subscriber network)
5—TCP flows from a specific IP address on the subscriber side to a specific IP address on the
network side
6—Same as 5, but for the opposite direction (from the network side to the subscriber side)
7-12—Same as 1-6 but with a specific destination port common to all flows of the attack (1-6 are
port-less attack types, 7-12 are port-based attack types)
13-24—Same as 1-12 but for UDP instead of TCP
25-28—Same as 1-4 but for ICMP instead of TCP
29-32—Same as 1-4 but for Other protocols instead of TCP
Rate of new flows
Rate of suspected flows (In general, suspected flows are flows for which the SCOS did not see
proper establishment (TCP) or saw only a single packet (all other protocols)).
Chapter 12 Identifying and Preventing Distributed Denial-of-Service Attacks
OL-30621-02