Alcatel OmniSwitch 6624 Network Configuration Manual page 240

IP Configuration
In the next minute, 10 more TCP and UDP closed port packets are received, along with 200 UDP open
port packets. This would bring the total penalty value to 4300, as shown with the following equation:
(100 previous minute value) + (10 TCP X 10 penalty) + (10 UDP X 10 penalty) +
(200 UDP X 20 penalty) = 4300
This value would be divided by 2 (due to decay) and decreased to 2150. The switch would record a port
scan and generate a trap to warn the administrator:
10 TCP closed port packets
10 UDP closed port packets
100 UDP open port packets
The above functions and how to set their values are covered in the sections that follow.
Setting Penalty Values
There are three types of traffic you can set a penalty value for:
TCP/UDP packets bound for closed ports.
•
TCP traffic bound for open ports.
•
UDP traffic bound for open ports.
•
Each type has its own command used to assign a penalty value. Penalty values can be any non-negative
integer. Each time a packet is received that matches an assigned penalty, the total penalty value for the
switch is increased by the penalty value of the packet in question.
To assign a penalty value to TCP/UDP packets bound for a closed port, use the
penalty command with a penalty value. For example, to assign a penalty value of 10 to TCP/UDP packets
destined for closed ports, enter the following:
-> ip dos close-port-penalty 10
To assign a penalty value to TCP packets bound for an open port, use the
penalty command with a penalty value. For example, to assign a penalty value of 10 to TCP packets
destined for opened ports, enter the following:
-> ip dos scan tcp open-port-penalty 10
To assign a penalty value to UDP packets bound for an open port, use the
penalty command with a penalty value. For example, to assign a penalty value of 10 to TCP/UDP packets
destined for closed ports, enter the following:
-> ip dos scan udp open-port-penalty 10
page 12-12
DoS Settings
UDP/TCP closed = 10
UDP open =20
TCP open = 5
Threshold = 2000
Decay = 25
OmniSwitch 6648
Minute 2 Penalty Total = 2150
OmniSwitch 6624/6648 Network Configuration Guide
Configuring IP
Generate DoS
Attack Warning
Trap
ip dos scan close-port-
ip dos scan tcp open-port-
ip dos scan udp open-port-
April 2004