CLI Reference Guide-R01

Chapter 9 | General Security Measures
Denial of Service Protection
– 358 –
dos-protection
echo-chargen
This command protects against DoS echo/chargen attacks in which the echo
service repeats anything sent to it, and the chargen (character generator) service
generates a continuous stream of data. When used together, they create an infinite
loop and result in a denial-of-service. Use the no form without the bit rate
parameter to disable this feature, or with the bit rate parameter to restore the
defautl rate limit..
Syntax
dos-protection echo-chargen [bit-rate-in-kilo rate]
no dos-protection echo-chargen [bit-rate-in-kilo]
rate – Maximum allowed rate. (Range: 64-2000 kbits/second)
Default Setting
Disabled, 1000 kbits/second
Command Mode
Global Configuration
Example
Console(config)#dos-protection echo-chargen bit-rate-in-kilo 65
Console(config)#
dos-protection land This command protects against DoS LAND (Local Area Network Denial) attacks in
which hackers send spoofed-IP packets where the source and destination address
are the same, thereby causing the target to reply to itself continuously. Use the no
form to disable this feature.
Syntax
[no] dos-protection land
dos-protection tcp-syn-fin-scan Protects against DoS TCP-SYN/FIN-scan attacks GC
dos-protection tcp-udp-port-zero Protects against attacks which set the Layer 4 source
or destination port to zero
GC
dos-protection tcp-xmas-scan Protects against DoS TCP-XMAS-scan attacks GC
dos-protection udp-flooding Protects against DoS UDP-flooding attacks GC
dos-protection win-nuke Protects against DoS WinNuke attacks GC
show dos-protection Shows the configuration settings for DoS protection PE
Table 66: DoS Protection Commands (Continued)
Command Function Mode