Brocade Communications Systems ServerIron ADX 12.4.00a - Manual (Page 141)

ServerIron ADX Security Guide 127
53-1002440-03
DDoS protection
5
Configuring a rule for common attack types
As described in “Configuring a Generic Rule” on page 125, you can create a custom rule to manage
DDoS attacks. In addition, ServerIron ADX has built-in rules to manage common attack types. In
this case, the rule command is used with a <rule-name> variable specified in Table 13.
The following example configures a the "filter1" security filter with a rule to drop packets that are
associated with a "xmas tree" attack.
ServerIronADX(config)# security filter filter1
ServerIronADX(config-sec-filter1)#rule xmas-tree drop
Syntax: [no] rule <rule-name> [log | no-log] [drop | no-drop]
The <rule-name> variable is specified as one of the options described in Table 13.
The log parameter directs the ServerIron ADX to log traffic on the bound interface that matches the
rule specified by the configured <rule-name>. The no-log parameter disables this function.
The drop parameter directs the ServerIron ADX to drop traffic on the bound interface that matches
the rule specified by the configured <rule-name>. The no-drop parameter disables this function.
TABLE 13 Rules for common attack types and descriptions
Attack Type Description
syn-fragments A SYN-fragment attack floods the target host with SYN-packet fragments.
The host stores the fragments, in order to reassemble them. By not
completing the connection, and flooding the server or host with such
fragmented SYN packets, the host’s memory buffer would eventually fill up.
A SYN packet need not be fragmented. It is very small. Use syn-fragments to
drop any SYN packet with the more-fragments bit on.
syn-and-fin-set Attacker sends a packet with both SYN and FIN bits set to see what kind of
system reply is returned, and then use the system information for further
attacks using known system vulnerabilities.
Use syn-and-fin-set to drop packets having both the SYN and FIN bits set in
the flags field
tcp-no-flags TCP packets are normally sent with at least one bit set in the flags field.
Use tcp-no-flags to drop TCP packet with a missing or malformed flags field.
icmp-fragments ICMP fragments can be used to exploit the vulnerabilities in the packet
reassembly code. Enabling icmp-fragments allows you to create a rule that
can be configured to drop or log fragmented ICMP packets.
deny-all-fragments IP fragments can be used to exploit the vulnerabilities in the packet
reassembly code of specific IP stack implementations. When you enable
deny-all-fragments, the ServerIron ADX drops all IP fragments.
land-attack Attacker sends spoofed SYN packets containing the destination IP as the
source-IP address. Flooding a system with such empty connections can
overwhelm the system, causing DoS.
Use land-attack to drop packets containing the same IP address as both the
source and destination IP addresses.
ping-of-death If the sum of "Fragment Offset" and "Total length" fields in the IP header of
each IP fragment is larger than 65,535, then the packet is invalid, and such
packet will be dropped.