Dhcp offer packet, Dns rogue hack, Large icmp packet – H3C Technologies H3C Intelligent Management Center User Manual
Page 47: Ping of death attack
38
anomaly templates that uses type-specific parameters, see "
Modifying an anomaly template that uses
DHCP Offer Packet
1.
Access the Anomaly Detection page.
2.
In the anomaly detection template list, click the Modify icon
for DHCP Offer Packet.
The Modify Anomaly Detection page appears.
3.
In the Valid DHCP Servers area, enter the IP address of a valid DHCP server in the Host IP field,
and click Add.
The IP address appears in the Host IP List field. You can specify up to 10 IP addresses. To delete
an IP address, select the IP address and click Delete.
4.
In the DHCP Monitor Time area, perform the following tasks:
a.
Select one or more days of a week for the Monitor Data field.
b.
In the Start Time field, enter the start time in the format of hh:mm.
c.
In the End Time field, enter the end time in the format of hh:mm.
5.
Click OK.
DNS Rogue Hack
1.
Access the Anomaly Detection page.
2.
In the anomaly detection template list, click the Modify icon
for DNS Rogue Hack.
The Modify Anomaly Detection page appears.
3.
In the Host IP field, enter the IP address of a valid DNS server, and click Add.
The IP address appears in the Host IP List field. You can specify up to 10 IP addresses. To delete
an IP address, select the IP address and click Delete.
4.
Click OK.
Large ICMP Packet
1.
Access the Anomaly Detection page.
2.
In the anomaly detection template list, click the Modify icon
for Large ICMP Packet.
The Modify Anomaly Detection page appears.
3.
In the Packet Size field, enter the ICMP packet size threshold.
If the size of an ICMP packet exceeds the threshold, UBA monitors the ICMP packet.
4.
Click OK.
Ping of Death Attack
1.
Access the Anomaly Detection page.
2.
In the anomaly detection template list, click the Modify icon
for Ping of Death Attack.
The Modify Anomaly Detection page appears.
3.
In the Packet Size field, enter the ping packet size threshold.
If the size of a ping packet exceeds the threshold, UBA monitors the ICMP packet.
4.
Click OK.