Administrator Guide

Security Commands 1033
Denial of Service Commands
Dell Networking N1500/N2000/N3000/N4000 Series Switches
The Dell Networking DoS capability supports a package of filters intended to
provide network administrators the ability to reduce network exposure to
common attack vectors. The following list shows the DoS attack detection
Dell Networking supports.
•SIP=DIP:
– Source IP address = Destination IP address.
•First Fragment:
– TCP Header size smaller then configured value.
•TCP Fragment:
–IP Fragment Offset = 1.
• TCP Flag:
– TCP Flag SYN set and Source Port < 1024 or TCP Control Flags = 0
and
– TCP Sequence Number = 0 or TCP Flags FIN, URG, and PSH set
and
– TCP Sequence Number = 0 or TCP Flags SYN and FIN set.
•L4 Port:
– Source TCP/UDP Port = Destination TCP/UDP Port.
•ICMP:
– Limiting the size of ICMP Ping packets.
•SMAC=DMAC:
– Source MAC address = Destination MAC address.
•TCP Port:
– Source TCP Port = Destination TCP Port.
•UDP Port:
– Source UDP Port = Destination UDP Port.
• TCP Flag & Sequence:
2CSNXXX_SWUM204.book Page 1033 Monday, January 25, 2016 1:25 PM