Specifications

2-140
Cisco SCE 2000 and SCE 1000 CLI Command Reference
OL-26797-03
Chapter 2 CLI Command Reference
ip filter monitor
ip filter monitor
Configures the limits for permitted and not-permitted IP address transmission rates.
ip filter monitor [permitted | ip_not_permitted] low_rate low_rate high_rate high_rate burst
burst size
Syntax Description
Command Default low rate = 20 Mbps
high rate = 20 Mbps
burst size = 10 seconds
Command Modes Global configuration
Command History This table includes the following release-specific history entries:
Usage Guidelines Management security is defined as the capability of the SCE platform to cope with malicious
management conditions that might lead to global service failure.
There are two parallel security mechanisms:
• Automatic security mechanism — monitors the TCP/IP stack rate at 200 msec intervals and throttles
the rate from the device if necessary.
• User-configurable security mechanism — accomplished via two IP filters at user-configurable
intervals:
– IP fragment filter: Drops all IP fragment packets
Use the ip filter fragment command to enable the IP fragment filter.
– IP filter monitor: Measures the rate of accepted and dropped packets for both permitted and
not-permitted IP addresses.
This command configures the IP filter monitor.
Use the ip permitted keyword to apply configured limits to permitted IP addresses.
Use the ip not-permitted keyword to apply configured limits to not-permitted IP addresses.
low_rate Lower threshold; the rate in Mbps that indicates the attack is no longer
present
high_rate Upper threshold; the rate in Mbps that indicates the presence of an attack
burst size Duration of the interval in seconds that the high and low rates must be
detected in order for the threshold rate to be considered to have been
reached
Release Modification
3.0.0 This command was introduced.