How To Display A Specified Attack Detector Configuration - Cisco SCE8000 Configuration Manual

Chapter 10 Identifying and Preventing Distributed-Denial-Of-Service Attacks

How to display a specified attack detector configuration

•
•
The following information is displayed:
•
•
•
•
•
Options
The following option is available:
•
From the SCE> prompt, type show interface linecard 0 attack-detector number and press Enter.
Step 1
Example
SCE>show interface LineCard 0 attack-detector 1
Detector #1:
Comment: 'Sample'
Access-list: 1
Effective only for TCP port(s) 21,23,80
Effective for all UDP ports
Protocol|Side|Direction
--------|----|-----------||------|----------|------------|-------|-----|-----
TCP
TCP
TCP
TCP
TCP
TCP
TCP+port|net.|source-only||Block |
TCP+port|net.|dest-only
TCP+port|sub.|source-only||Block |
TCP+port|sub.|dest-only
TCP+port|net.|source+dest||
TCP+port|sub.|source+dest||
UDP
UDP
UDP
UDP
OL-16479-01
Options, page 10-23
Example, page 10-23
Protocol Side — Whether the attack detector applies to attacks originating at the subscriber or
network side.
Direction — Whether the attack detector applies to single sided or dual sided attacks. Action to take
if an attack is detected.
Thresholds:
open-flows-rate — Default threshold for rate of open flows (new open flows per second).
–
suspected-flows-rate — Default threshold for rate of suspected DDoS flows (new suspected
–
flows per second).
suspected-flows-ratio — Default threshold for ratio of suspected flow rate to open flow rate.
–
Subscriber notification — enabled or disabled.
Alarm: sending an SNMP trap enabled or disabled.
number — the number of the attack detector to display
||Action|
| | ||
| | ||
|net.|source-only||
|net.|dest-only ||
|sub.|source-only||
|sub.|dest-only ||
|net.|source+dest||
|sub.|source+dest||
||
||
|net.|source-only||
|net.|dest-only ||
|sub.|source-only||
|sub.|dest-only ||
Thresholds
|Open flows|Ddos-Suspected flows|notif|
|rate |rate
| |
| |
| |
| |
| |
| |
| |
| |
|
| |
| |
| |
| |
| |
| |
| |
Cisco SCE8000 Software Configuration Guide, Rel 3.1.6S
Monitoring Attack Filtering
|Sub- |Alarm
|ratio | |
| | |
| | |
| | |
| | |
| | |
| | |
| |Yes
| | |
| | |Yes
| | |
| | |
| | |
| | |
| | |
| | |
| | |
10-23