896
icmp-flood detect ip
Use
icmp-flood detect ip
to configure IP address-specific ICMP flood attack detection.
Use
undo icmp-flood detect ip
to remove the IP address-specific ICMP flood attack detection
configuration.
Syntax
icmp-flood detect ip
ip-address
[
vpn-instance vpn-instance-name
] [
threshold
threshold-value
]
[
action
{ {
drop
|
logging
} * |
none
} ]
undo icmp-flood detect
ip
ip-address
[
vpn-instance vpn-instance-name
]
Default
IP address-specific ICMP flood attack detection is not configured.
Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
ip-address
: Specifies the IPv4 address to be protected. The
ip-address
argument cannot be
255.255.255.255 or 0.0.0.0.
vpn-instance vpn-instance-name
: Specifies the MPLS L3VPN instance to which the protected IP
address belongs. The
vpn-instance-name
argument is a case-sensitive string of 1 to 31 characters.
Do not specify this option if the protected IP address is on the public network.
threshold
threshold-value
: Specifies the threshold for triggering ICMP flood attack prevention. The
value range is 1 to 1000000 in units of ICMP packets sent to the specified IP address per second.
action
: Specifies the actions when an ICMP flood attack is detected. If no action is specified, the
global actions set by the
icmp-flood action
command apply.
drop
: Drops subsequent ICMP packets destined for the protected IP address.
logging
: Enables logging for ICMP flood attack events.
none
: Takes no action.
Usage guidelines
With ICMP flood attack detection configured for an IP address, the device is in attack detection state.
When the sending rate of ICMP packets to the IP address reaches the threshold, the device enters
prevention state and takes the specified actions. When the rate is below the silence threshold
(three-fourths of the threshold), the device returns to the attack detection state.
Examples
# Configure ICMP flood attack detection for 192.168.1.2 in the attack defense policy
atk-policy-1
.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] icmp-flood detect ip 192.168.1.2 threshold
2000
Related commands
icmp-flood action
icmp-flood detect non-specific
icmp-flood threshold
Summary of Contents for FlexNetwork MSR Series
Page 1005: ...987 ...
