Brocade Communications Systems ServerIron ADX 12.4.00a User Manual
Page 142

128
ServerIron ADX Security Guide
53-1002440-03
DDoS protection
5
fin-with-no-ack
TCP packets with a FIN flag normally have an ACK bit set.
Use fin-with-no-ack to drop TCP packet where FIN flag is set, but the ACK bit
is not set.
large icmp
ICMP packets greater than 1500 bytes.
unknown-ip-protocol
Protocol 101 and above are currently reserved and undefined. Attackers
sometimes use protocol values that are not valid protocols.
Use unknown-ip-protocol
to 101 or greater. Replace the
the ServerIron ADX gets an IP protocol packet matching that number, the
packet will be dropped.
address-sweep
Attacker scans the network for information behind the ServerIron ADX,
uncovering an address to target. For example, sending ping requests to
10.1.1.1 through 100. A reply from any device indicates a server exists.
Use address-sweep
different addresses being accessed from one remote source. If the same
client sends a request to different IP addresses, then the ServerIron ADX
keeps track of the number of IP address the client is trying to access. If the
number exceeds the configured
all the packets from that client will start being dropped (reset) for the
specified
and it does not start when the client accesses the first IP address.
For example, consider the command address-sweep 2 8. A client can access
only a maximum of two IP addresses. As soon as it accesses the third IP
within a 5-second interval, the ServerIron ADX will hold the client down for 8
minutes. Accessing two IP addresses within 5 seconds is permissible in this
example.
Use security net-scan-mon-interval
(5 seconds).
port-scan
Attacker sends traffic using the same source IP to different ports on the
same destination IP, with the intent of identifying a service to target.
The ServerIron ADX tracks the number of IP destination and port pairs. For
example, if a client accessed IP 1 and port 0, that counts as one
Use port-scan to internally log the number of different ports scanned from
one source. If the number exceeds a configured
(for example, 10 ports in 5 seconds), the ServerIron ADX will flag it as an
attack and reject all traffic from that source for the
The default internal timer value is 5 seconds. Use security
net-scan-mon-interval
xmas-tree
A Xmas tree attack is detected when a packet with the URG,PSH & FIN flags
set is detected.
icmp-type
Different types and subtypes of ICMP can be used to attack or to gain
knowledge about the host or network, which would then be used for an
attack. For example, ICMP timestamp (type 13) will elicit a timestamp reply
from Unix systems, but Microsoft Windows would not do so. A hacker can
then attack known vulnerabilities of the system.
Use icmp-type to configure an ICMP software rule to drop specific ICMP
types and subtypes.
TABLE 13
Rules for common attack types and descriptions