Cisco SCE8000 Configuration Manual page 199

Chapter 10 Identifying and Preventing Distributed-Denial-Of-Service Attacks
•
•
•
How to Define the Default Action and Optionally the Default Thresholds
Defaults
The default values for the default attack detector are:
•
•
•
•
Step 1 From the SCE(config if)# prompt, type
(specific|not- specific|both)])|ICMP|other|all) attack-direction
(single-side-source|single-side-destination|single-side-both|dual-sided|all) side
(subscriber|network|both) [action (report|block)] [open-flows-rate number suspected-flows-rate
rate suspected-flows-ratio ratio
Configures the default attack detector for the defined attack type.
From the SCE(config if)# prompt, type attack-detector default protocol (((TCP|UDP) [dest-port
Step 2
(specific|not- specific|both)])|ICMP|other|all) attack-direction
(single-side-source|single-side-destination|single-side-both|dual-sided|all) side
(subscriber|network|both) (notify-subscriber|don't-notify-subscriber) and press Enter.
Enables or disables subscriber notification by default for the defined attack type.
The attack type must be defined the same as in Step 1.
Step 3 From the SCE(config if)# prompt, type attack-detector default protocol (((TCP|UDP) [dest-port
(specific|not- specific|both)])|ICMP|other|all) attack-direction
(single-side-source|single-side-destination|single-side-both|dual-sided|all) side
(subscriber|network|both) (alarm|no-alarm) and press Enter.
Enables or disables sending an SNMP trap by default for the defined attack type.
The attack type must be defined the same as in Step 1.
OL-16479-01
Thresholds:
open-flows-rate — Default threshold for rate of open flows. suspected-flows-rate — Default
–
threshold for rate of suspected DDoS flows.
suspected-flows-ratio — Default threshold for ratio of suspected flow rate to open flow rate.
–
Use the appropriate keyword to enable or disable subscriber notification by default:
notify-subscriber — Enable subscriber notification.
–
don't-notify-subscriber — Disable subscriber notification.
–
Use the appropriate keyword to enable or disable sending an SNMP trap by default:
alarm — Enable sending an SNMP trap.
–
no-alarm — Disable sending an SNMP trap.
–
Action — Report
Thresholds — Varies according to the attack type
Subscriber notification — Disabled
Sending an SNMP trap — Disabled
ttack-detector default protocol (((TCP|UDP) [dest-port
a
and press Enter.
]
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
Configuring Attack Detectors
10-11