Alcatel 9000 Guía de usuario descargar pdf (Pagina 235)

Configuring IP IP Configuration

OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006 page 12-15

Use the ip directed-broadcast command to enable or disable IP-directed broadcasts. For example:

-> ip directed-broadcast off

Use the show ip config command to display the IP-directed broadcast state.

Denial of Service (DoS) Filtering

By default, the switch filters denial of service (DoS) attacks, which are security attacks aimed at devices

that are available on a private network or the Internet. Some of these attacks aim at system bugs or vulner-

ability (for example, teardrop attacks), while other types of attacks involve generating large volumes of

traffic so that network service will be denied to legitimate network users (such as pepsi attacks). These

attacks include the following:

• ICMP Ping of Death—Ping packets that exceed the largest IP datagram size (65535 bytes) are sent to a

host and hang or crash the system.

• SYN Attack—Floods a system with a series of TCP SYN packets, resulting in the host issuing SYN-

ACK responses. The half open TCP connections can exhaust TCP resources, such that no other TCP

connections are accepted.

• Land Attack—Spoofed packets are sent with the SYN flag set to a host on any open port that is listen-

ing. The machine may hang or reboot in an attempt to respond.

• Teardrop/Bonk/Boink attacks—Bonk/boink/teardrop attacks generate IP fragments in a special way to

exploit IP stack vulnerabilities. If the fragments overlap the way those attacks generate packets, an

attack is recorded. Since teardrop, bonk, and boink all use the same IP fragmentation mechanism to

attack, these is no distinction between detection of these attacks. The old IP fragments in the fragmen-

tation queue is also reaped once the reassemble queue goes above certain size.

• Pepsi Attack—The most common form of UDP flooding directed at harming networks. A pepsi attack

is an attack consisting of a large number of spoofed UDP packets aimed at diagnostic ports on network

devices. This can cause network devices to use up a large amount of CPU time responding to these

packets.

The switch can be set to detect various types of port scans by monitoring for TCP or UDP packets sent to

open or closed ports. Monitoring is done in the following manner:

• Packet penalty values set. TCP and UDP packets destined for open or closed ports are assigned a

penalty value. Each time a packet of this type is received, its assigned penalty value is added to a

running total. This total is cumulative and includes all TCP and UDP packets destined for open or

closed ports.

• Port scan penalty value threshold.The switch is given a port scan penalty value threshold. This

number is the maximum value the running penalty total can achieve before triggering an SNMP trap.

• Decay value. A decay value is set. The running penalty total is divided by the decay value every

minute.

• Trap generation. If the total penalty value exceeds the set port scan penalty value threshold, a trap is

generated to alert the administrator that a port scan may be in progress.

For example, imagine that a switch is set so that TCP and UDP packets destined for closed ports are given

a penalty of 10, TCP packets destined for open ports are given a penalty of 5, and UDP packets destined

for open ports are given a penalty of 20. The decay is set to 2, and the switch port scan penalty value

threshold is set to 2000:

1 2 ... 230 231 232 233 234 235 236 237 238 239 240 ... 701 702

Comentarios a estos manuales

Sin comentarios

Alcatel 9000 Guía de usuario Pagina 235

Comentarios a estos manuales

Relacionado con productos y manuales para Software Alcatel 9000