Specifications

2-20
Cisco SCE 2000 and SCE 1000 CLI Command Reference
OL-26797-03
Chapter 2 CLI Command Reference
attack-detector default
attack-detector default
Defines default thresholds and attack handling action. If a specific attack detector is defined for a
particular situation (protocol/attack direction/side), it will override these defaults. Use the no version of
this command to delete the user-defined defaults. The system defaults will then be used.
attack-detector default protocol protocol attack-direction attack-direction side side [action
action ] [open-flows open-flows] [ddos-suspected-flows ddos-suspected-flows]
[suspected-flows-ratio suspected-flows-ratio] [notify-subscriber | dont-notify-subscriber]
[alarm |noalarm]
no attack-detector default protocol protocol attack-direction attack-direction side side [action
action] [open-flows open-flows] [ddos-suspected-flows ddos-suspected-flows]
[suspected-flows-ratio suspected-flows-ratio]
Syntax Description
Command Default The default values for the default attack detector are:
• Action = Report
• Thresholds — Varies according to the attack type
• Subscriber notification = Disabled
• Sending an SNMP trap = Disabled
Command Modes LineCard Interface Configuration
Command History This table includes the following release-specific history entries:
Usage Guidelines The following arguments must always be specified:
• protocol
• attack-direction
• side
protocol TCP, UDP, IMCP, other
attack-direction attack-source, attack-destination, both
side subscriber, network, both
action report, block
open-flows Threshold for concurrently open flows (new open flows per second).
ddos-suspected-flows Threshold for DDoS-suspected flows (new suspected flows per second).
suspected-flows-ratio Threshold for ratio of suspected flow rate to open flow rate.
Release Modification
2.5.7 This command was introduced.