Zte ZXR10 8900 Series Command Manual page 92

ZXR10 8900 Series Command Manual (FW Volume)
Parameter
Description
Example
76 Confidential and Proprietary Information of ZTE CORPORATION
Parameter
add
protect_name
<string>
icmpflood
<number1>
ipsweep
<number2>
synflood
<number3>
udpflood
<number4>
portscan
<number5>
log
yes|no
action
pass|block
To add one intrusion detection rule, set address of protected host
to hostA, deny packets passing through and record it in log, exe-
cute the following command:
# dos rule add protect_name hostA icmpflood 800 ipsweep
8 synflood 300 udpflood 300 portscan 8 log yes action
block
Description
This adds one host or subnet to be protected.
This sets address resource to be protected,
which can be host, subnet or address range.
This address resource shall be added in
command define in advance.
This is one string, indicating the name of
address resource.
This sets the max reply requests initiated to
protected object per second.
This is one number, indicating max connection
requests, 500 by default, ranging from 1 to
-65535.
This sets the max ICMP packets sent from
the same one IP to multiple hosts within
the specified interval. When packet number
reaches this threshold, it believes that
addresses are scanned for one time.
This is one number, in range of 1-65535.
This sets the max connection requests
initiated to protected object per second.
This is one number, 500 by default, ranging
from 1 to -65535.
This sets the max UDP packets sent to
protected object per second. When the packet
number reaches this threshold, UDP flooding
attack protection function is enabled.
This is one number, 1000 by default, ranging
from 1 to -65535.
This sets the max IP packets containing TCP
SYN segment sent from the same one source
IP to multiple ports of destination IP within
the specified interval. When packet number
reaches this threshold, it believes that ports
are scanned for one time.
This is one number, in range of 1-65535.
When attack event occurs, it sets whether to
record it into log.
yes: Record the event into log; no: Don't
record the event into log.
It sets whether to permit packets to pass
through.
pass: It indicates permitting packets to pass
through; block: It indicates denying packets
passing through.