ECS4660-28F_Management Guide-R03

C HAPTER 29 | General Security Measures
Denial of Service Protection
– 1156 –
dos-protection
tcp-xmas-scan
This command protects against DoS TCP-xmas-scan in which a so-called
TCP XMAS scan message is used to identify listening TCP ports. This scan
uses a series of strangely configured TCP packets which contain a sequence
number of 0 and the URG, PSH and FIN flags. If the target's TCP port is
closed, the target replies with a TCP RST packet. If the target TCP port is
open, it simply discards the TCP XMAS scan. Use the no form to disable
this feature.
SYNTAX
[no] dos-protection tcp-xmas-scan
DEFAULT SETTING
Enabled
COMMAND MODE
Global Configuration
EXAMPLE
Console(config)#dos-protection tcp-xmas-scan
Console(config)#
show
dos-protection
This command shows the configuration settings for the DoS protection
commands.
COMMAND MODE
Privileged Exec
EXAMPLE
Console#show dos-protection
Global DoS Protections:
LAND Attack : Enabled
TCP Null Scan : Enabled
TCP SYN/FIN Scan : Enabled
TCP XMAS Scan : Enabled
Console#