Web Management Guide-R03

Chapter 12 | Security Measures
DoS Protection
– 339 –
Protection for ICMP
◆ Smurf – Protects against smurf attacks in which a perpetrator generates a large
amount of spoofed ICMP Echo Request traffic to the broadcast destination IP
address (255.255.255.255), all of which uses a spoofed source address of the
intended victim. The victim should crash due to the many interrupts required
to send ICMP Echo response packets.
◆ Ping of Death – Protects against ping-of-death attacks in which an attacker
deliberately sends an IP packet larger than the 65,536 bytes allowed by the IP
protocol, or by using fragmentation in which a packet broken down into
fragments could add up to more than the allowed 65,536 bytes. Some
operating systems do not know how to respond when they receive an
oversized packet, so they freeze, crash, or reboot.
◆ Nuke – Protects against nuke attacks which send fragmented or otherwise
invalid ICMP packets using a modified ping utility to repeatedly send the
corrupted data, thus slowing down the affected host until it comes to a
complete stop. Nuke attacks may also send an ICMP packets (usually through
port 139) with a “destination unreachable” message to cause connection
breaks.
◆ Flood – Protects against flooding attacks in which large amounts of (or just
over-sized) ICMP packets are sent to a host in order to attempt to crash the TCP/
IP stack on the host. An ICMP flood can consist of any type of ICMP message,
including smurf, ping-flood, or ping-of-death attacks. (Maximum allowed rate:
64-2048 kbits/second)
Other Protection Commands
◆ Echo/Chargen – Protects against Echo/Chargen attacks in which the echo
service repeats anything sent to it, and the chargen (character generator)
service generates a continuous stream of data. When used together, they
create an infinite loop and result in denial-of-service. (Maximum allowed rate:
64-2048 kbits/second)
Web Interface
To protect against DoS attacks:
1. Click Security, DoS Protection.
2. Enable any of the required protection features, and set the maximum rate of
ingress for flooding attacks or Echo/Chargen.
3. Click Apply