Allied-telesis AT-S63 Manual de usuario descargar pdf (Pagina 451)

100

101

AT-S63 Management Software Command Line Interface User’s Guide

451

SET DOS TEARDROP

Syntax

set dos teardrop port=

port

state=enable|disable

[mirrorport=auto|

port

]

Parameters

port Specifies the switch ports on which you want to

enable or disable this DoS defense. You can select

more than one port at a time.

state Specifies the state of the DoS defense. The options

are:

enable Activates the defense.

disable Deactivates the defense. This is the default.

mirrorport Specifies a port where invalid traffic is copied. You can

specify only one port.

Description

This command activates and deactivates the Teardrop DoS defense.

In this DoS attack, an attacker sends a packet in several fragments with a

bogus offset value, used to reconstruct the packet, in one of the

fragments to a victim. This results in the victim being unable to

reassemble the packet, possibly causing it to freeze operations.

The defense mechanism for this type of attack has all ingress IP traffic

received on a port sent to the switch’s CPU. The CPU samples related,

consecutive fragments, checking for fragments with invalid offset

values. If one is found, the following occurs:

❑ The switch sends a trap to the management stations.

❑ The switch port discards the fragment with the invalid offset and,

for a one minute period, discards all ingress IP fragments on the

port.

Because the CPU examines only a sampling of the ingress IP traffic on a

port, there is no guarantee that the switch will caught or prevent this

type of attack.

1 2 ... 446 447 448 449 450 451 452 453 454 455 456 ... 463 464

Comentarios a estos manuales

Sin comentarios

Allied-telesis AT-S63 Manual de usuario Pagina 451

Comentarios a estos manuales

Relacionado con productos y manuales para Hardware De La Computadora Allied-telesis AT-S63