Zyxel OLT2412 [297/326] Ddos overview

OLT2412 User’s Guide 297

CHAPTER 44

DDoS

44.1 DDoS Overview

A distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network

resource unavailable to its intended users. One common method of attack involves saturating the

target machine with external communications requests, so much so that it cannot respond to

legitimate traffic or responds so slowly as to be rendered essentially unavailable. Such attacks

usually lead to a server overload. In general terms, DoS attacks are implemented by either forcing

the targeted computer(s) to reset, or consuming its resources so that it can no longer provide its

intended service or obstructing the communication media between the intended users and the

victim so that they can no longer communicate adequately.

44.2 DDoS Setup

The show dos status command displays the current DDoS configuration status:

You can use the dos enable <item_number|all> command to enable a specific item or all items,

and the no dos enable <item_number|all> command to disable them.

OLT2412# show dos status

Item Name Status

---- ----------------------------------------------- -------

1 Source IP equal Destination IP enable

2 MAC Source Addr equal MAC Destination Addr enable

3 MAC Source Addr are zero enable

4 TCP flags : SYN = 1 & ACK = 0 & SRC_Port < 1024 disable

5 TCP flags : All TCP flags = 0 disable

6 V4 first fragment check disable

7 TCP flags : FIN = 1 & URG = 1 & PSH = 1 disable

8 TCP flags : SYN = 1 & FIN = 1 disable

9 TCP Source Port equal Destination Port disable

10 UDP Source Port equal Destination Port disable

11 TCP packets with not full TCP header disable

12 TCP Header offset equals to 1 are dropped disable

13 Enable ICMP size check disable

14 Fragmented ICMP packets check disable