CLI Reference Guide-R02

Chapter 9 | General Security Measures
Denial of Service Protection
– 360 –
Example
Console(config)#dos-protection tcp-xmas-scan
Console(config)#
dos-protection
udp-flooding
This command protects against DoS UDP-flooding attacks in which a perpetrator
sends a large number of UDP packets (with or without a spoofed-Source IP) to
random ports on a remote host. The target will determine that application is
listening at that port, and reply with an ICMP Destination Unreachable packet. It
will be forced to send many ICMP packets, eventually leading it to be unreachable
by other clients. Use the no form without the bit rate parameter to disable this
feature, or with the bit rate parameter to restore the default rate limit.
Syntax
dos-protection udp-flooding [bit-rate-in-kilo rate]
no dos-protection udp-flooding [bit-rate-in-kilo]
rate – Maximum allowed rate. (Range: 64-2000 kbits/second)
Default Setting
Disabled, 1000 kbits/second
Command Mode
Global Configuration
Example
Console(config)#dos-protection udp-flooding bit-rate-in-kilo 65
Console(config)#
dos-protection
win-nuke
This command protects against DoS WinNuke attacks in which affected the
Microsoft Windows 3.1x/95/NT operating systems. In this type of attack, the
perpetrator sends the string of OOB out-of-band (OOB) packets contained a TCP
URG flag to the target computer on TCP port 139 (NetBIOS), casing it to lock up and
display a “Blue Screen of Death.” This did not cause any damage to, or change data
on, the computer’s hard disk, but any unsaved data would be lost. Microsoft made
patches to prevent the WinNuke attack, but the OOB packets still put the service in
a tight loop that consumed all available CPU time. Use the no form without the bit
rate parameter to disable this feature, or with the bit rate parameter to restore the
default rate limit.
Syntax
dos-protection win-nuke [bit-rate-in-kilo rate]
no dos-protection win-nuke [bit-rate-in-kilo]