How To Define The Action And Optionally The Thresholds For A Specific Attack Detector - Cisco SCE 8000 10GBE Software Configuration Manual

Configuring Attack Detectors

How to Define the Action and Optionally the Thresholds for a Specific Attack Detector

From the SCE(config if)# prompt, type:
Command
attack-detector number protocol (((TCP|UDP)
[dest-port (specific|not-
specific|both)])|ICMP|other|all)
attack-direction
(single-side-source|single-side-destination|sing
le-side-both|dual-sided|all) side
(subscriber|network|both) [action
(report|block)] [open-flows-rate number
suspected-flows-rate rate suspected-flows-ratio
ratio]
How to Define the Subscriber Notification Setting for a Specific Attack Detector
Use the following command to set the subscriber notification setting for a given attack detector and
selected set of attack types.
From the SCE(config if)# prompt, type:
Command
attack-detector number protocol (((TCP|UDP)
[dest-port (specific|not-
specific|both)])|ICMP|other|all)
attack-direction
(single-side-source|single-side-destination|sing
le-side-both|dual-sided|all) side
(subscriber|network|both)
(notify-subscriber|don't-notify-subscriber)
How to Define the SNMP Trap Setting for a Specific Attack Detector
Use the following command to enable or disable sending an SNMP trap for a given attack detector and
selected set of attack types.
From the SCE(config if)# prompt, type:
Command
attack-detector number protocol (((TCP|UDP)
[dest-port (specific|not-
specific|both)])|ICMP|other|all)
attack-direction
(single-side-source|single-side-destination|sing
le-side-both|dual-sided|all) side
(subscriber|network|both) (alarm|no-alarm)
Cisco SCE 8000 10GBE Software Configuration Guide
12-16
Chapter 12 Identifying and Preventing Distributed Denial-of-Service Attacks
Purpose
Defines the action of the specified attack detector.
Purpose
Defines the subscriber notification setting for the
specified attack detector.
Purpose
Defines the SNMP trap setting for the specified
attack detector.
OL-30621-02