ECS4110-28T_Management Guide

C HAPTER 25 | General Security Measures
Denial of Service Protection
– 959 –
dos-protection
tcp-flooding
This command protects against DoS TCP-flooding attacks in which a
perpetrator sends a succession of TCP SYN requests (with or without a
spoofed-Source IP) to a target and never returns ACK packets. These
half-open connections will bind resources on the target, and no new
connections can be made, resulting in a denial of service. Use the no form
to disable this feature.
SYNTAX
dos-protection tcp-flooding [bit-rate-in-kilo rate]
no dos-protection tcp-flooding
rate – Maximum allowed rate. (Range: 64-2000 kbits/second)
DEFAULT SETTING
Disabled, 1000 kbits/second
COMMAND MODE
Global Configuration
EXAMPLE
Console(config)#dos-protection tcp-flooding 65
Console(config)#
dos-protection
tcp-null-scan
This command protects against DoS TCP-null-scan attacks in which a TCP
NULL scan message is used to identify listening TCP ports. The scan uses a
series of strangely configured TCP packets which contain a sequence
number of 0 and no flags. If the target's TCP port is closed, the target
replies with a TCP RST (reset) packet. If the target TCP port is open, it
simply discards the TCP NULL scan. Use the no form to disable this feature.
SYNTAX
[no] dos-protection tcp-null-scan
DEFAULT SETTING
Enabled
COMMAND MODE
Global Configuration
EXAMPLE
Console(config)#dos-protection tcp-null-scan
Console(config)#