Specifications

2-24
Cisco SCE 2000 and SCE 1000 CLI Command Reference
OL-26797-03
Chapter 2 CLI Command Reference
attack-detector <number>
attack-detector <number>
Configures a specific attack detector for a particular attack type (protocol/attack direction/side) with the
assigned number. Use the default form of this command to configure the default attack detector for the
specified attack type. Use the no form of this command to delete the specified attack detector.
attack-detector number protocol (((TCP|UDP) [dest-port destination port ])|ICMP|other|all)
attack-direction attack-direction side side [action action ] [open-flows open-flows ]
[ddos-suspected-flows ddos-suspected-flows ] [suspected-flows-ratio suspected-flows-ratio ]
[notify-subscriber|dont-notify-subscriber] [alarm|no-alarm]
no attack-detector number
attack-detector default protocol (((TCP|UDP) [dest-port destination port ])|ICMP|other|all)
attack-direction attack-direction side side [action action ] [open-flows open-flows ]
[ddos-suspected-flows ddos-suspected-flows ] [suspected-flows-ratio suspected-flows-ratio ]
[notify-subscriber|dont-notify-subscriber] [alarm|no-alarm]
no attack-detector default protocol (((TCP|UDP) [dest-port destination port ])|ICMP|other|all)
attack-direction attack-direction side side
default attack-detector {all |all-numbered}
default attack-detector number protocol (((all | IMCP | other | TCP | UDP) [dest-port
destination port attack-direction attack-direction side side
Syntax Description
Command Default The default values for the default attack detector are:
• Action = Report
• Thresholds = Varies according to the attack type
• Subscriber notification = Disabled
• Sending an SNMP trap = Disabled
number Assigned number for attack-detector
protocol TCP, UDP, IMCP, other
destination port {TCP and UDP protocols only): Defines whether the default attack detector
applies to specific (port-based) or not specific (port-less) detections.
specific, not-specific, both
attack-direction single-side-destination, single-side-both, dual-sided, all
side subscriber, network, both
action report, block
open-flows-rate Threshold for rate of open flows (new open flows per second).
suspected-flows-rate Threshold for for rate of suspected DDoS flows (new suspected flows per
second)
suspected-flows-ratio Threshold for ratio of suspected flow rate to open flow rate.