Login
- Table of Contents
-
- 09-Security Configuration Guide
- 00-Preface
- 01-AAA configuration
- 02-Password control configuration
- 03-Public key management
- 04-PKI configuration
- 05-SSL configuration
- 06-IPsec configuration
- 07-SSH configuration
- 08-IP source guard configuration
- 09-ARP attack protection configuration
- 10-uRPF configuration
- 11-FIPS configuration
- 12-Attack detection and prevention configuration
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 12-Attack detection and prevention configuration | 38.74 KB |
Configuring attack detection and prevention
Overview
Attack detection and prevention enables a device to detect attacks by inspecting arriving packets, and to drop attack packets to protect a private network.
The device supports only TCP fragment attack prevention.
Enabling TCP fragment attack prevention
The TCP fragment attack prevention feature takes effect only on Layer 3 packets.
This feature enables the device to drop attack TCP fragments to prevent TCP fragment attacks that traditional packet filter cannot detect. As defined in RFC 1858, attack TCP fragments refer to the following TCP fragments:
· First fragments in which the TCP header is smaller than 20 bytes.
· Non-first fragments with a fragment offset of 8 bytes (FO=1).
To enable TCP fragment attack prevention:
|
Command |
Remarks |
|
|
1. Enter system view. |
system-view |
N/A |
|
2. Enable TCP fragment attack prevention. |
attack-defense tcp fragment enable |
By default, TCP fragment attack prevention is enabled. |
