CLI Reference Guide-R01

Chapter 9 | General Security Measures
Denial of Service Protection
– 361 –
Default Setting
Disabled
Command Mode
Global Configuration
Example
Console(config)#dos-protection tcp-syn-fin-scan
Console(config)#
dos-protection
tcp-udp-port-zero
This command protects against DoS attacks in which the TCP or UDP source port or
destination port is set to zero. This technique may be used as a form of DoS attack,
or it may just indicate a problem with the source device. When this command is
enabled, the switch will drop these packets. Use the no form to restore the default
setting.
Syntax
[no] dos-protection tcp-udp-port-zero
Default Setting
Disabled
Command Mode
Global Configuration
Example
Console(config)#dos-protection tcp-udp-port-zero
Console(config)#
dos-protection
tcp-xmas-scan
This command protects against DoS TCP-xmas-scan in which a so-called TCP XMAS
scan message is used to identify listening TCP ports. This scan uses a series of
strangely configured TCP packets which contain a sequence number of 0 and the
URG, PSH and FIN flags. If the target's TCP port is closed, the target replies with a
TCP RST packet. If the target TCP port is open, it simply discards the TCP XMAS scan.
Use the no form to disable this feature.
Syntax
[no] dos-protection tcp-xmas-scan
Default Setting
Disabled
Command Mode
Global Configuration