Configurable Options; Display Options; Traps And Logs - Juniper SYSTEM BASICS - CONFIGURATION GUIDE V 11.1.X Configuration Manual

DoS attacks. Group membership is based on physical port and control protocol; all
flows in that group are considered suspicious.

Configurable Options

You can configure the following options for suspicious flow detection:
You can also clear the following:

Display Options

For monitoring purposes, you can:

Traps and Logs

The system generates a trap and a log message under the following conditions:
Global on or off. When the option is set to off, flows or packets are not marked
as suspicious. The default is on.
Actions a line module takes when the suspicious flow table on the line module
overflows:
Overflow Stop recognizing new suspicious flows
Group Group flows into logical groupings where some individual flows are
monitored as a group
Suspicious threshold for each protocol. The threshold is the rate in packets per
second at which a flow becomes suspicious. A zero setting disables suspicious
flow detection for the protocol. Flows are subject to protocol and priority rate
limits, but not to suspicious flow detection.
Low threshold for each protocol. The threshold rate determines whether an
interface transitions from suspicious back to nonsuspicious. A zero setting means
that the flow does not transition back to nonsuspicious based on packet rate.
Backoff time in seconds for each protocol. After this period expires, the flow
transitions to nonsuspicious regardless of the current rate. When set to zero, an
interface does not return to the nonsuspicious state using a time mechanism.
All suspicious flows from the suspicious flow table for a specific slot.
Suspicious flows from the suspicious flow table for the entire system.
A single suspicious flow; returns the flow to the nonsuspicious state.
Display all suspicious control flows when the system has recognized an attack.
Display the current state and the number of transitions into suspicious state for
the protocol and priority.
Display historical counts about the number of flows made suspicious.
View a trap or log generated when a control flow is considered suspicious.
View a trap or log generated when a control flow is no longer suspicious.
Chapter 7: Passwords and Security
Denial of Service (DoS) Protection
453