Login
- Table of Contents
-
- 19-Security Command Reference
- 00-Preface
- 01-Object group commands
- 02-Keychain commands
- 03-Public key management commands
- 04-PKI commands
- 05-Crypto engine commands
- 06-SSH commands
- 07-SSL commands
- 08-Security zone commands
- 09-Packet filter commands
- 10-ASPF commands
- 11-Security policy commands
- 12-Session management commands
- 13-DHCP snooping commands
- 14-DHCPv6 snooping commands
- 15-ARP attack protection commands
- 16-ND attack defense commands
- 17-Attack detection and prevention commands
- 18-mGRE commands
- 19-Connection limit commands
- 20-IP-based attack prevention commands
- 21-IP source guard commands
- 22-uRPF commands
- 23-APR commands
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 20-IP-based attack prevention commands | 38.38 KB |
IP-based attack prevention commands
Naptha attack prevention commands
tcp anti-naptha enable
Use tcp anti-naptha enable to enable Naptha attack prevention.
Use undo tcp anti-naptha enable to disable Naptha attack prevention.
Syntax
tcp anti-naptha enable
undo tcp anti-naptha enable
Default
Naptha attack prevention is disabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
After you enable Naptha attack prevention, the device checks the number of TCP connections in each state. If the number of TCP connections in a state exceeds the limit, the device will accelerate the aging of the TCP connections in that state. The TCP connection limits are set by the tcp state command.
Examples
# Enable Naptha attack prevention.
<Sysname> system-view
[Sysname] tcp anti-naptha enable
Related commands
tcp state
tcp state
Use tcp state to set the maximum number of TCP connections in a state.
Use undo tcp state to restore the default.
Syntax
tcp state { closing | established | fin-wait-1 | fin-wait-2 | last-ack } connection-limit number
undo tcp state { closing | established | fin-wait-1 | fin-wait-2 | last-ack } connection-limit
Default
The maximum number of TCP connections in each state (CLOSING, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, and LAST_ACK) is 50.
Views
System view
Predefined user roles
network-admin
Parameters
closing: Specifies the CLOSING state.
established: Specifies the ESTABLISHED state.
fin-wait-1: Specifies the FIN_WAIT_1 state.
fin-wait-2: Specifies the FIN_WAIT_2 state.
last-ack: Specifies the LAST_ACK state.
connection-limit number: Specifies the maximum number of TCP connections, in the range of 0 to 500. The value of 0 represents that the device does not accelerate the aging of the TCP connections in a state.
Usage guidelines
This command takes effect after you enable Naptha attack prevention. If the number of TCP connections in a state exceeds the limit, the device will accelerate the aging of the TCP connections in the state.
Examples
# Set the maximum number of TCP connections in the ESTABLISHED state to 100.
<Sysname> system-view
[Sysname] tcp state established connection-limit 100
Related commands
tcp anti-naptha enable
