Table of Contents
Advertisement
Monitoring Attack Filtering
How to display a specified attack detector configuration
•
•
The following information is displayed:
•
•
•
•
•
Options
The following option is available:
•
From the SCE> prompt, type show interface linecard 0 attack-detector number and press Enter.
Step 1
Example
SCE>show interface LineCard 0 attack-detector 1
Detector #1:
Comment: 'Sample'
Access-list: 1
Effective only for TCP port(s) 21,23,80
Effective for all UDP ports
Protocol|Side|Direction
|
|
--------|----|-----------||------|----------|------------|-------|-----|-----
TCP
TCP
TCP
TCP
TCP
TCP
TCP+port|net.|source-only||Block |
TCP+port|net.|dest-only
TCP+port|sub.|source-only||Block |
TCP+port|sub.|dest-only
TCP+port|net.|source+dest||
TCP+port|sub.|source+dest||
UDP
UDP
UDP
UDP
Cisco SCE 2000 and SCE 1000 Software Configuration Guide
11-24
Options, page 11-24
Example, page 11-24
Protocol Side — Whether the attack detector applies to attacks originating at the subscriber or
network side.
Direction — Whether the attack detector applies to single sided or dual sided attacks. Action to take
if an attack is detected.
Thresholds:
open-flows-rate — Default threshold for rate of open flows (new open flows per second).
–
suspected-flows-rate — Default threshold for rate of suspected DDoS flows (new suspected
–
flows per second).
suspected-flows-ratio — Default threshold for ratio of suspected flow rate to open flow rate.
–
Subscriber notification — enabled or disabled.
Alarm: sending an SNMP trap enabled or disabled.
number — the number of the attack detector to display
||Action|
|
||
|Open flows|Ddos-Suspected flows|notif|
|
||
|rate
|net.|source-only||
|net.|dest-only
||
|sub.|source-only||
|sub.|dest-only
||
|net.|source+dest||
|sub.|source+dest||
||
||
|net.|source-only||
|net.|dest-only
||
|sub.|source-only||
|sub.|dest-only
||
Chapter 11
Identifying and Preventing Distributed-Denial-Of-Service Attacks
Thresholds
|rate
|ratio
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|Sub- |Alarm
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|Yes
|
|
|
|
|
|Yes
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
OL-7827-12
Advertisement
Table of Contents
