Table of Contents
Advertisement
10 TCP closed port packets
10 UDP closed port packets
100 UDP open port packets
The above functions and how to set their values are covered in the sections that follow.
Setting Penalty Values
There are three types of traffic you can set a penalty value for:
•
TCP/UDP packets bound for closed ports.
•
TCP traffic bound for open ports.
•
UDP traffic bound for open ports.
Each type has its own command to assign a penalty value. Penalty values can be any non-negative integer.
Each time a packet is received that matches an assigned penalty, the total penalty value for the switch is
increased by the penalty value of the packet in question.
To assign a penalty value to TCP/UDP packets bound for a closed port, use the
penalty
command with a penalty value. For example, to assign a penalty value of 10 to TCP/UDP packets
destined for closed ports, enter the following:
-> ip dos scan close-port-penalty 10
To assign a penalty value to TCP packets bound for an open port, use the
penalty
command with a penalty value. For example, to assign a penalty value of 10 to TCP packets
destined for opened ports, enter the following:
-> ip dos scan tcp open-port-penalty 10
To assign a penalty value to UDP packets bound for an open port, use the
penalty
command with a penalty value. For example, to assign a penalty value of 10 to TCP/UDP packets
destined for closed ports, enter the following:
-> ip dos scan udp open-port-penalty 10
Setting the Port Scan Penalty Value Threshold
The port scan penalty value threshold is the highest point the total penalty value for the switch can reach
before a trap is generated informing the administrator that a port scan is in progress.
To set the port scan penalty value threshold, enter the threshold value with the
command. For example, to set the port scan penalty value threshold to 2000, enter the following:
page 1126
DoS Settings
UDP/TCP closed = 10
UDP open =20
TCP open = 5
Threshold = 2000
Decay = 2
Minute 2 Penalty Total = 2150
OmniSwitch AOS Release 7 Network Configuration Guide
Generate DoS
Attack Warning
Trap
ip dos scan close-port-
ip dos scan tcp open-port-
ip dos scan udp open-port-
ip dos scan threshold
March 2011
Advertisement
Table of Contents
