Configuring a rule for common attack types, Table 13 – Brocade Communications Systems ServerIron ADX 12.4.00a User Manual
Page 141

ServerIron ADX Security Guide
127
53-1002440-03
DDoS protection
5
Configuring a rule for common attack types
As described in
on page 125, you can create a custom rule to manage
DDoS attacks. In addition, ServerIron ADX has built-in rules to manage common attack types. In
this case, the rule command is used with a
The following example configures a the "filter1" security filter with a rule to drop packets that are
associated with a "xmas tree" attack.
ServerIronADX(config)# security filter filter1
ServerIronADX(config-sec-filter1)#rule xmas-tree drop
Syntax: [no] rule
The
The log parameter directs the ServerIron ADX to log traffic on the bound interface that matches the
rule specified by the configured
The drop parameter directs the ServerIron ADX to drop traffic on the bound interface that matches
the rule specified by the configured
TABLE 13
Rules for common attack types and descriptions
Attack Type
Description
syn-fragments
A SYN-fragment attack floods the target host with SYN-packet fragments.
The host stores the fragments, in order to reassemble them. By not
completing the connection, and flooding the server or host with such
fragmented SYN packets, the host’s memory buffer would eventually fill up.
A SYN packet need not be fragmented. It is very small. Use syn-fragments to
drop any SYN packet with the more-fragments bit on.
syn-and-fin-set
Attacker sends a packet with both SYN and FIN bits set to see what kind of
system reply is returned, and then use the system information for further
attacks using known system vulnerabilities.
Use syn-and-fin-set to drop packets having both the SYN and FIN bits set in
the flags field
tcp-no-flags
TCP packets are normally sent with at least one bit set in the flags field.
Use tcp-no-flags to drop TCP packet with a missing or malformed flags field.
icmp-fragments
ICMP fragments can be used to exploit the vulnerabilities in the packet
reassembly code. Enabling icmp-fragments allows you to create a rule that
can be configured to drop or log fragmented ICMP packets.
deny-all-fragments
IP fragments can be used to exploit the vulnerabilities in the packet
reassembly code of specific IP stack implementations. When you enable
deny-all-fragments, the ServerIron ADX drops all IP fragments.
land-attack
Attacker sends spoofed SYN packets containing the destination IP as the
source-IP address. Flooding a system with such empty connections can
overwhelm the system, causing DoS.
Use land-attack to drop packets containing the same IP address as both the
source and destination IP addresses.
ping-of-death
If the sum of "Fragment Offset" and "Total length" fields in the IP header of
each IP fragment is larger than 65,535, then the packet is invalid, and such
packet will be dropped.