ECS4110-52T_Management Guide

C HAPTER 13 | Security Measures
DoS Protection
– 399 –
DOS PROTECTION
Use the Security > DoS Protection page to protect against denial-of-service
(DoS) attacks. A DoS attack is an attempt to block the services provided by
a computer or network resource. This kind of attack tries to prevent an
Internet site or service from functioning efficiently or at all. In general, DoS
attacks are implemented by either forcing the target to reset, to consume
most of its resources so that it can no longer provide its intended service,
or to obstruct the communication media between the intended users and
the target so that they can no longer communicate adequately. This section
describes how to protect against DoS attacks.
CLI REFERENCES
◆ "Denial of Service Protection" on page 957
PARAMETERS
These parameters are displayed:
◆ Echo/Chargen Attack – Attacks in which the echo service repeats
anything sent to it, and the chargen (character generator) service
generates a continuous stream of data. When used together, they
create an infinite loop and result in a denial-of-service.
(Default: Disabled)
◆ Echo/Chargen Attack Rate – Maximum allowed rate.
(Range: 64-2000 kbits/second; Default: 1000 kbits/second)
◆ Smurf Attack – Attacks in which a perpetrator generates a large
amount of spoofed ICMP Echo Request traffic to the broadcast
destination IP address (255.255.255.255), all of which uses a spoofed
source address of the intended victim. The victim should crash due to
the many interrupts required to send ICMP Echo response packets.
(Default: Enabled)
◆ TCP Flooding Attack – Attacks in which a perpetrator sends a
succession of TCP SYN requests (with or without a spoofed-Source IP)
to a target and never returns ACK packets. These half-open
connections will bind resources on the target, and no new connections
can be made, resulting in a denial of service. (Default: Disabled)
◆ TCP Flooding Attack Rate – Maximum allowed rate. (Range: 64-2000
kbits/second; Default: 1000 kbits/second)
◆ TCP Null Scan – A TCP NULL scan message is used to identify listening
TCP ports. The scan uses a series of strangely configured TCP packets
which contain a sequence number of 0 and no flags. If the target's TCP
port is closed, the target replies with a TCP RST (reset) packet. If the
target TCP port is open, it simply discards the TCP NULL scan.
(Default: Enabled)
◆ TCP-SYN/FIN Scan – A TCP SYN/FIN scan message is used to identify
listening TCP ports. The scan uses a series of strangely configured TCP
packets which contain SYN (synchronize) and FIN (finish) flags. If the