User Manual

S350 Series 24-Port (PoE+) and 48-Port Gigabit Ethernet Smart Managed Pro Switches
Configure System Information User Manual57
6. Select the types of DoS attacks for the switch to monitor and block and configure any
associated values:
• Denial of Service Min TCP Header Size. Specify the minimum
TCP header size
allowed. If DoS
TCP Fragment is enabled, the switch drops packets with a TCP
header smaller than the configured value. The default value is 20.
• Denial of Service ICMPv4. Enabling ICMPv4 DoS prevention causes the switch to
drop ICMPv4 packets with a type set to ECHO_REQ (ping) and a size greater than
the configured ICMPv4 packet size.
• Denial of Service Max ICMPv4 Packet Size. Specify the maximum ICMPv4 packet
size allowed. If ICMPv4 DoS prevention is enabled, the switch drops IPv4 ICMP ping
packets with a size greater than the configured value. The default value is 512.
•
Denial of Service ICMPv6. Enabling ICMPv6 DoS prevention causes the switch to
drop ICMPv6 packets with a type set to ECHO_REQ (ping) and a size greater than
the configured ICMPv6 packet size.
• Denial of Service Max ICMPv6 Packet Size. Specify the maximum ICMPv6 packet
size allowed. If ICMPv6 DoS prevention is enabled, the switch drops IPv6 ICMP ping
packets with a size greater than the configured value.
The default value is 512.
•
Denial of Service First Fragment. Enabling First Fragment DoS prevention causes
the switch to check DoS options for the first-fragment IP packets if the switch receives
fragmented IP packets. Otherwise, the switch ignores the first-fragment IP packets.
• Denial of Service ICMP Fragment. Enabling ICMP Fragment DoS prevention
causes the switch to drop ICMP fragmented packets.
• Denial of Service Smurf. Enabling Smurf DoS prevention causes the switch to drop
broadcast ICMP echo request packet.
• Denial of Service SIP=DIP. Enabling SIP=DIP DoS prevention causes the switch to
drop packets with a source IP address equal to the destination IP address.
• Denial of Service SMAC=DMAC. Enabling SMAC=DMAC DoS prevention causes
the switch to drop packets with a source MAC address equal to the destination MAC
address.
• Denial of Service TCP FIN&URG&PSH. Enabling
TCP FIN & URG & PSH DoS
prevention causes the switch to drop packets with
TCP flags FIN, URG, and PSH set
and the TCP sequence number equal to 0.
• Denial of Service TCP Flag&Sequence. Enabling TCP Flag DoS prevention causes
the switch to drop packets with
TCP control flags set to 0 and the TCP sequence
number set to 0.
• Denial of Service TCP Fragment. Enabling TCP Fragment DoS prevention causes
the switch to drop packets with a
TCP payload for which the IP payload length minus
the IP header size is less than the minimum allowed TCP header size.
• Denial of Service TCP Offset. Enabling TCP Of
fset DoS prevention causes the
switch to drop packets with a TCP header offset set to 1.
• Denial of Service TCP Port. Enabling TCP Port DoS prevention causes the switch to
drop packets for which the
TCP source port is equal to the TCP destination port.