CLI Reference Guide-R04

Chapter 9 | General Security Measures
Denial of Service Protection
– 373 –
Example
Console#show ip arp inspection vlan 1
VLAN ID DAI Status ACL Name ACL Status
-------- --------------- -------------------- --------------------
1 disabled sales static
Console#
Denial of Service Protection
A denial-of-service attack (DoS attack) is an attempt to block the services provided
by a computer or network resource. This kind of attack tries to prevent an Internet
site or service from functioning efficiently or at all. In general, DoS attacks are
implemented by either forcing the target to reset, to consume most of its resources
so that it can no longer provide its intended service, or to obstruct the
communication media between the intended users and the target so that they can
no longer communicate adequately.
This section describes commands used to protect against DoS attacks.
dos-protection land This command protects against DoS LAND (Local Area Network Denial) attacks in
which hackers send spoofed-IP packets where the source and destination address
are the same, thereby causing the target to reply to itself continuously. Use the no
form to disable this feature.
Syntax
[no] dos-protection land
Default Setting
Disabled
Command Mode
Global Configuration
Table 65: DoS Protection Commands
Command Function Mode
dos-protection land Protects against DoS LAND attacks GC
dos-protection tcp-null-scan Protects against DoS TCP-null-scan attacks GC
dos-protection tcp-syn-fin-scan Protects against DoS TCP-SYN/FIN-scan attacks GC
dos-protection tcp-xmas-scan Protects against DoS TCP-XMAS-scan attacks GC
show dos-protection Shows the configuration settings for DoS protection PE