Usage Scenario

An IP header contains a Don't Fragment (DF) bit to identify whether packet fragmentation is allowed. Commonly, if the DF bit of a packet is set to 1, the packet cannot be fragmented. When the remote device or intermediate forwarding device receives IP packets, if it checks the packet length and discards packets whose length is longer than the Maximum Transmission Unit (MTU) on the interface, network communication is interrupted. You can run the clear ip df command to enable fragmentation for outgoing control-plane IP packets so that packets with the DF bit set to 1 are fragmented based on the MTU value on the interface.

After fragmentation for outgoing control-plain IP packets is enabled on an interface, the device sets the Don't Fragment (DF) field to 0 and fragments IP packets that meet the following conditions:

• The value of the DF field in the IP packet header is 1.

• The packet length is larger than the MTU value of the interface that sends the packets.

Precautions

This command takes effect only for the control-plain packets but not for the forwarding-plain packets.

Usage Scenario

IP packets can carry route options including the route alert option (ra), route record option (rr), source route option (srr), and timestamp option (ts).

These route options are used to diagnose network paths and temporarily transmit special services. These options, however, may be used by attackers to spy on the network structure for initiating attacks. This degrades network security and device performance. To solve this problem, you can run the discard { ra | rr | srr | ts } command to configure the device to discard the IP packets that contain the route options.

Precautions

The discard { ra | rr | srr | ts } command only takes effect for the packets on inbound interfaces.

The discard { ra | rr | srr | ts } command only takes effect for packets sent to the CPU. For packets that are not sent to the CPU, the device processes and forwards them using the same method of processing packets without route options regardless of whether the discard { ra | rr | srr | ts } command is configured or not.

To view information about ICMP packet sending and receiving, run the display icmp statistics command.

You can run this command to check whether IPv4 Layer 3 unicast forwarding is enabled on a switch.

A socket monitor monitors and records each connection. A RawLink also monitors interfaces. The socket monitor records specific protocol events that occur during operations. In addition, it logs information in the disk space.

The socket monitor is similar to a black box of the system. It records specific events that happen during system operations. When the system fails, you can use information recorded by the socket monitor to locate faults.

You can also set the filtering rules, such as the task ID, socket ID, and socket type so that only the information matching the rules is displayed. This reduces information output and helps you locate faults accurately and efficiently.

As defined in RFC standards, port numbers larger than 1024 are non-well-known port numbers and can be assigned to desired services, such as NQA and FTP services. However, a non-well-known port number can be assigned to only one service on the same device. If you assign a non-well-known port number to two or more services, this port number takes effect for only the latest configured service. As a result, the other services using this port number will fail.

Before you assign a non-well-known port number to a service, run the display ip socket register-port command to check non-well-known port numbers that have been assigned to other services, preventing service failures caused by conflicts of non-well-known port numbers.

You can run this command to view socket information about the virtual CPU. If a fault occurs in the system, you can use socket information about the virtual CPU to locate the fault.

IP traffic statistics include statistics about received packets (including discarded packets that carry source-route options), sent packets, fragmented packets, and reassembled packets. If a large number of bad protocol and no route fields is displayed in the command output, the device receives a large volume of IP packets of unknown protocol types and IP packets for which no routes can be found. In this situation, the device may be attacked by the connected devices.

Using the display load-balance mode packet or the display load-balance mode flow command displays information about the LPU adopting the specified load balancing mode.

The display load-balance mode slot slot-number command displays the load balancing mode on a specified LPU.

If neither the slot ID nor load balancing mode is specified in the display load-balance mode command, by default, load balancing modes on all the registered interface boards are displayed in the sequence of their slot IDs.by default, load balancing mode on the switch is displayed.

The display network status command is used to check the network status, such as the running interfaces and services on the network. For example, when you find that an interface is being used by an unknown module during a security scan, run the command to check out the module.

This command displays the 802.1p priority and DSCP priority that are set in the system.

The display priority command displays information only after the set priority command is executed to set the 802.1p priority or DSCP priority.

Usage Scenario

The statistics about RawIP packets include the number of sent RawIP packets and the number of received RawIP packets.

RSVP, OSPF, and ICMP packets are encapsulated into RawIP packets to be sent. During the ping operation, for example, you can run the display rawip statistics command to view the number of RawIP packets sent by the local device to check whether the abnormality on the network is caused by abnormal sending and receiving of RawIP packets.

If you want to diagnose problems and monitor information of specific applications, configure verbose in the display rawip statistics command to display application-specific RawIP packet statistics. The applications can be ICMP, RSVP, OSPF, and others.

Precautions

The number of packets received by a switch includes the number of forwarded packets, packets sent to the upper layer, and discarded packets.

The Simple Network Management Protocol (SNMP) is a standard network management protocol widely used on TCP/IP networks. It uses a central computer (a network management station) that runs network management software to manage network elements. The management agent on the network element automatically reports traps to the network management station. After that, the network administrator immediately takes measures to resolve the problem.

Prerequisites

SNMP has been enabled. See snmp-agent.

Usage Scenario

After the trap function of a specified feature is enabled, you can run the display snmp-agent trap feature-name ip all command to check the status of all traps of IP. You can use the snmp-agent trap enable feature-name ip command to enable the trap function of IP.

The Simple Network Management Protocol (SNMP) is a standard network management protocol widely used on TCP/IP networks. It uses a central computer (a network management station) that runs network management software to manage network elements. The management agent on the network element automatically reports traps to the network management station. After that, the network administrator immediately takes measures to resolve the problem.

Prerequisites

SNMP has been enabled. See snmp-agent.

Usage Scenario

After the trap function of a specified feature is enabled, you can run the display snmp-agent trap feature-name tcp all command to check the status of all traps of TCP. You can use the snmp-agent trap enable feature-name tcp command to enable the trap function of TCP.

The command displays TCP traffic statistics including different types of received and sent packets. For example, duplicate received packets and packets with checksum errors. In addition, connection-related statistics are displayed, for example, times of accepted connections, the number of retransmitted packets, and the number of keepalive packets.

Most of the preceding statistics are expressed in number of packets, and some of them are expressed in number of bytes.

Usage Scenario

You can set filtering rules based on the Task ID, socket ID, IP address and port number of the local device, and IP address and port number of the remote device so that only the information matching the rules is displayed. This prevents unnecessary information from being displayed and helps you locate faults accurately and efficiently.

Precautions

The command output is null if there is no TCP connection.

The command displays UDP traffic statistics including different types of received and sent packets. For example, packets with checksum errors. In addition, connection-related statistics are displayed, for example, the number of broadcast packets. The preceding statistics are expressed in number of packets.

If static IPv4 blackhole routes are configured on the switch configured with the user access and authentication function, when a user goes offline, only the IPv4 blackhole route corresponding to the user's address segment exists on the switch. When a tracert packet matches the IPv4 blackhole route, the switch discards the packet. As a result, an initiator cannot detect that the user has gone offline.

After you run the icmp blackhole unreachable send command, the switch sends a Destination Unreachable ICMP packet to an initiator, notifying the initiator that the user has gone offline if a user goes offline and a tracert packet matches the IPv4 blackhole route.

The ping program is used to check network connectivity. If two hosts cannot ping each other, they cannot set up a connection. The ping program uses the ICMP protocol. It encapsulates ICMP Echo Request packets into IP packets, and sends the packets to the destination host. The destination host must return an ICMP Echo Reply packet to the source host. If the source host receives a reply within a certain period, the source host considers that the destination host is reachable.

In normal situations, after an interface receives an ICMP Echo Request, this packet is sent to the protocol stack and handled by the CPU.

When the ping command is run to check network connectivity, if the destination address is a broadcast address, all the devices receiving this ICMP Echo Request in the broadcast domain will handle this packet. If attackers initiate attacks using the ping program, the device has to continuously handle ICMP packets, causing a high CPU usage and degrading forwarding performance.

To disable the device from responding to the ICMP Echo Request packets of which the destination addresses are broadcast addresses, run the undo icmp broadcast-address echo enable command. This command can improve forwarding capacity of the device.

NOTE:

The icmp broadcast-address echo enable command makes sense only for ICMP Echo Request packets.

Usage Scenario

ICMP error packets contain network information, such as network connectivity, host reachability, and route availability. ICMP error packets are ultimately returned to the sender because the sender is the logical receiver of the ICMP error packets. The sender learns about the error types from the ICMP error packets, and then determines how to retransmit the data.

After receiving an IP packet, if the device finds that the destination is unreachable, the device discards the packet, and returns a Destination Unreachable packet to the source.

After you run the undo icmp host-unreachable send command, the device does not send ICMP Host Unreachable packets externally. This prevents the peer device from processing a large number of ICMP packets.

Precautions

If the function of sending ICMP Host Unreachable packets is disabled, the switch does not send ICMP Host Unreachable packets in any situations.

This command needs to be configured on the inbound interface of ICMP packets in the interface view.

Usage Scenario

ICMP error packets contain network information, such as network connectivity, host reachability, and route availability. ICMP error packets are ultimately returned to the sender because the sender is the logical receiver of the ICMP error packets. The sender learns about the error types from the ICMP error packets, and then determines how to retransmit the data.

After receiving an IP packet, if the device finds that the destination is unreachable, the device discards the packet, and returns a Destination Unreachable packet to the source.

After you run the icmp port-unreachable send command, the device does not send ICMP Port Unreachable packets externally. This prevents the peer device from processing a large number of ICMP packets.

Precautions

If the function of sending ICMP Port Unreachable packets is disabled, the switch does not send ICMP Port Unreachable packets in any situations.

ICMP error packets contain network information, such as network connectivity, host reachability, and route availability. ICMP error packets are ultimately returned to the sender because the sender is the logical receiver of the ICMP error packets. The sender learns about the error types from the ICMP error packets, and then determines how to retransmit the data.

After receiving an IP packet, if the device finds that the destination is unreachable, the device discards the packet, and returns a Destination Unreachable packet to the source.

After you run the icmp protocol-unreachable send command, the device does not send ICMP Protocol Unreachable packets externally. This prevents the peer device from processing a large number of ICMP packets.

Usage Scenario

• On secure networks, the device can normally receive ICMP packets. In the case of heavy traffic on the network, if hosts or ports are frequently unreachable, the device will receive a large number of ICMP packets, which causes heavier traffic burdens over the network and degrades the performance of the device.

• On insecure networks, network attackers often make use of ICMP error packets to probe on the internal structure of the network.

The undo icmp receive command can be used to disable the device from receiving ICMP packets for the purpose of improving network performance or enhancing network security.

If the network status is normal and the device is required to receive ICMP packets, you can run the icmp receive command.

Precautions

After the undo icmp receive command is run, the device no longer process ICMP packets of a certain type, causing the host to fail to ping the device.

Usage Scenario

ICMP error packets contain network information, such as network connectivity, host reachability, and route availability. ICMP error packets are ultimately returned to the sender because the sender is the logical receiver of the ICMP error packets. The sender learns about the error types from the ICMP error packets, and then determines how to retransmit the data.

ICMP Redirect packets are a type of ICMP error packets.

When a host starts, there may be only one default route to the gateway in its routing table. In the following situations, the device functions as a gateway to send an ICMP Redirect packet to the source host, requesting the host to select another next hop address for subsequent packet forwarding:

• The interface that receives the data packet is the same as the interface used to forward the packet.
• The device needs to forward a received packet. After looking up the routing table, the device finds that the next hop IP address is on the same network segment with the destination address of the packet.

After the device sends ICMP Redirect packets to the host that has only a few routes, the host can enrich the routing table and find out the optimal route.

The ICMP error packets facilitate network control and management. However, the inherent defects of the ICMP protocol make the routing devices and hosts be prone to attacks. Therefore, sending the ICMP error packets has the following defects:

• The ICMP packets increase traffic volume and burden the network devices.
• If a device receives a large number of malicious attack packets and needs to return ICMP error packets, the device is busy handling ICMP packets, and the device performance is degraded.
• The ICMP Redirect function increases the number of routes in the host's routing table. When many routes are added, the host performance will be degraded.

You need to decide whether to enable ICMP Redirect packet sending according to network situation.

Precautions

The command is used on the interface that receives ICMP packets.

Usage Scenario

TTL is a field in an IP packet that limits the lifespan of the IP packet on the network. The TTL value is set by the sender, and is reduced by 1 every time the packet passes a device. If a forwarding device receives an IP packet of which the TTL is 0 and the destination address is not the local address, the device discards this packet and returns an ICMP packet to the sender.

ICMP packets are encapsulated into IP packets. When receiving an ICMP packet of which the destination address is not the local address and the TTL value is 1, the device discards the packet and returns an ICMP Time Exceeded.

When receiving a packet of which the TTL value is 1, the switch sends the packet to the CPU. The tracert function implements hop-by-hop detection using the packets with TTL value 1. If an attacker sends a large number of IP packets with TTL value 1 to a target device, the CPU of the target device is busy handling these IP packets and returns ICMP Destination Unreachable packets. Therefore, the CPU usage becomes high.

If a switch is configured to discard the ICMP packets with TTL value 1, the pressure on the switch can be reduced and network attacks can be prevented.

Precautions

After the function is enabled on the device, the tracert command does not take effect.

If the destination address of a received IP packet is not the local address and the TTL value is 1, a timeout error occurs. In this situation, the device discards the packet and returns an ICMP Time Exceeded packet to the source.

When replying with an ICMP Time Exceeded packet, an interface adds its IP address as the source IP address in the ICMP Time Exceeded packet, exposing the interface itself to attackers. In addition, after being attacked, the interface replies with numerous ICMP Time Exceeded packets, consuming CPU resources and degrading system performance. To resolve these problems, run the undo icmp ttl-exceeded send command to disable the interface from replying with ICMP Time Exceeded packets.

ICMP error packets contain network information, such as network connectivity, host reachability, and route availability. ICMP error packets are ultimately returned to the sender because the sender is the logical receiver of the ICMP error packets. The sender learns about the error types from the ICMP error packets, and then determines how to retransmit the data.

After receiving an IP packet, if the device finds that the destination is unreachable, the device discards the packet, and returns a Destination Unreachable packet to the source.

The switch sends ICMP Destination Unreachable packets to the CPU for processing. When a large number of such packets are received, the CPU may be overloaded. To reduce the number of ICMP packets on the network, you can enable the switch to discard ICMP Destination Unreachable packets. After the configuration, the workload on the switch is reduced and malicious attacks can be prevented.

When the ping -r command is run to detect network connectivity, the IP packet is forwarded by Layer 3 routing devices. Every Layer 3 device fills its own IP address into the option field of the IP packet. When the IP packet reaches the destination, the ICMP Echo Reply packet should contain the IP addresses of all passing devices, including the devices on the forward and return paths. When the ping program receives the reply packet, it can display the IP addresses of all passing Layer 3 devices.

If the length of IP packet encapsulating the ICMP packet exceeds the interface MTU, this IP packet is fragmented. Only the IP header of the first fragment includes the option field. The fragment carrying the option field is sent to the protocol stack and processed by the CPU.

When malicious attacks are initiated using ICMP packets, the device needs to process a large number of fragments carrying the option field, so the forwarding performance of the device degrades. To reduce impact on the forwarding performance and prevent ICMP packet attacks, you can enable the LPU to discard the ICMP fragments carrying option fields.

Usage Scenario

The ping program is used to check network connectivity. If two hosts cannot ping each other, they cannot set up a connection. The ping program uses the ICMP protocol. It encapsulates ICMP Echo Request packets into IP packets, and sends the packets to the destination host. The destination host returns an ICMP Echo Reply packet to the source host. If the source host receives a reply within a certain period, the source host considers that the destination host is reachable.

In normal situations, after an interface receives an ICMP Echo Request packet, this packet is sent to the protocol stack and handled by the CPU.

After ICMP fast reply is enabled, if an interface receives an ICMP Echo Request packet of which the destination address is the local address, the packet is not sent to the protocol stack for handing by the CPU, but handled by the interface. This improves forwarding performance of the device.

Precautions

The fast ICMP reply function takes effect on sub-interfaces on switches since V200R010C00.

The fast ICMP reply function does not take effect on VBDIF interfaces.

Directed broadcast packets are sent to a specified network. In the destination IP address of a directed broadcast packet, the network number is that of the specified network and the host number is all 1s.

Hackers use directed broadcast packets to attack networks, which threatens the network security. Therefore, directed broadcast packets are isolated by Layer 3 switches in normal cases. However, in some scenarios, the device needs to receive or forward these directed broadcast packets. For example, when Wake on LAN (WOL) is configured on a PC, the command can be run to enable the interface to forward directed broadcast packets. (WOL enables a PC in dormancy or shutdown state to wake up from dormancy state to running state or turn from shutdown state to power-on state through the instruction from the peer of the network.)

The device can also be enabled to receive and forward a certain type of directed broadcast packets based on ACLs. For example, if the basic ACL is used, run the acl (system view) and rule (basic ACL view) commands to define the directed broadcast packets to be received and forwarded as permit, and then run the ip forward-broadcast command to bind this ACL.

Only broadcast packets that match the permit action defined in the ACL are forwarded. Broadcast packets that match the deny action defined in the ACL or do not match any ACL rules are not forwarded.

By default, the device identifies directed broadcast packets as malformed packets, and intercepts and discards them because the attack defense function of malformed packets is enabled on the device. In this case, the interface on the device cannot forward the directed broadcast packets.

To solve this problem, use either of the following methods:

• Run the anti-attack abnormal disable command to disable the attack defense function of malformed packets. However, after this command is configured, other malformed packets will not be intercepted and discarded, which brings certain security risks. Use this command with caution.

• Run the anti-attack disable command to disable all attack defense functions. However, after this command is configured, not only malformed packets but also fragmented, tcp-syn, udp-flood, and icmp-flood attack packets will not be intercepted and discarded, which brings certain security risks. Use this command with caution.

This command does not apply to VPN scenarios, address unnumbering scenarios, and scenarios of conflicts between host routes and subnet broadcast routes due to network segment overlapping.

Usage Scenario

When the device deployed with the ring network protocols (STP, RSTP, MSTP, SEP, ERPS, RRPP, VBST, and Smart Link) performs link switchover due to a link fault, the ARP entries need to be learned again. This deteriorates the Layer 3 convergence performance of IP traffic. If the device is enabled to perform Layer 2 forwarding for IP traffic during the switchover, the convergence performance can be improved. By default, the device is enabled from performing Layer 2 forwarding for IP traffic during ring network switchover.

Precautions

After the device is enabled to perform Layer 2 forwarding for IP traffic, it will forward the IP traffic in broadcast mode during ring network switchover. Therefore, the IP traffic increases within a short time.

You can run this command to disable IPv4 Layer 3 unicast forwarding on a switch.

After IPv4 Layer 3 unicast forwarding is disabled on a switch, the IPv4 routing function becomes ineffective on the switch, and the switch cannot forward Layer 3 packets based on the IPv4 routing table and FIB table.

Configuring source IP address verification enables an interface to check validity of source IP addresses of received packets. Packets with invalid addresses are discarded, which improves the network security.

The following IP addresses are illegal source addresses:

• Addresses with all 0s or 1s
• Multicast addresses (class D addresses)
• Class E addresses
• Loopback addresses that are not generated on local hosts (in 127.x.x.x format)
• Broadcast addresses of classes A, B, and C
• Subnet broadcast addresses that are on the same network segment as the address of the inbound interface

The interface only check validity of source IP addresses of the packets that need to be forwarded to the CPU, and does not check validity of source IP addresses of the packets that will be directly forwarded according to the FIB table.

If the mask in the IP address of the received packet is of 31 bits, the receiver considers it as a valid source address without checking the broadcast address of the subnet.

Run the display this command in the interface view to check configuration of checking validity of source IP addresses.

Usage Scenario

If the switch receives an IP packet that matches no routing entry in the local routing table, it sends the packet to the CPU. If a lot of IP packets match no routing entry because of an attack or incorrect network configuration, the CPU is busy. To prevent this problem, run the ipv4 destination-unreachable drop command to configure the switch to discard these packets.

Precautions

If you run the ipv4 destination-unreachable drop command, the switch does not respond to ICMP error packets when a route fails to match the routing policies. To enable the switch to respond to these ICMP packets, you need to run the undo ipv4 destination-unreachable drop command.

For the cards excluding X series cards, when both the ipv4 destination-unreachable drop command and the traffic policy command are run, both the drop action and the redirection action take effect. The ICMP redirection packets are discarded because the drop action has a higher priority than the redirection action. This leads to a redirection failure for ICMP packets. To make the redirection action for ICMP packets effective, run the undo ipv4 destination-unreachable drop command to disable the drop action. However, disabling the drop action will degrade the attack defense performance of the system. You must configure the two actions properly according to the network requirements.

For the EH1D2X48SEC0 card on the S9700, if the resource allocation mode is set to enhanced-ipv4 or ipv4-ipv6 6:1 using the assign resource-mode command, the ipv4 destination-unreachable drop command does not take effect.

Usage Scenario

By default, only packets on the control plane can be fragmented according to the MTU on an interface. Packets on the forwarding plane can be forwarded normally without limited by the MTU. When the remote device or intermediate forwarding device receives IP packets, if it checks the packet length and discards packets whose length is longer than the MTU on the interface, network communication is interrupted. For the X series cards, you can run the ipv4 fragment enable command to enable fragmentation for outgoing forwarding-plane IP packets so that packets on the forwarding plane are fragmented based on the MTU on the interface.

Precautions

Before configuring the ipv4 fragment enable command, set a proper MTU. If the MTU is small, there may be many fragments of IP packets, causing the Layer 3 forwarding performance of IP packets to deteriorate.

Usage Scenario

Generally, the device sends the IPv6 packets that do not match routing entries to the CPU for processing. If many IPv6 packets do not match routing entries because of an attack or improper network configurations, the CPU is busy. To prevent this situation, run the ipv6 destination-unreachable drop command to configure the switch to discard these packets.

Precautions

If the ipv6 destination-unreachable drop command is used and a traffic policy with the redirect action is configured, both the drop action and the redirect action take effect. Because the drop action has a higher priority than the redirect action, ICMPv6 Redirect packets are discarded. This leads to a redirection failure. To make the redirect action take effect, run the undo ipv6 destination-unreachable drop command to disable the drop action. However, disabling the drop action will degrade the attack defense performance of the system. You must configure the two actions properly according to network requirements.

After the ipv6 destination-unreachable drop command is used, the switch does not respond to the ICMPv6 Error packets caused when IPv6 packets do not match routing entries until the drop action is disabled.

For the EH1D2X48SEC0 and ET1D2X48SEC0 cards on the S9700, if the resource allocation mode is set to enhanced-ipv4 or ipv4-ipv6 6:1 using the assign resource-mode command, the ipv6 destination-unreachable drop command does not take effect.

Usage Scenario

If flow-based load balancing is used, the hash algorithm is used to calculate a value for selecting a link to forward packets. The value is calculated based on the protocol type, source IP address, destination IP address, source port number, and destination port number.

If packet-based load balancing is used, packets are forwarded through different links. Packet-based load balancing can be implemented only for packets forwarded by the CPU such as protocol packets.

Precautions

The load-balance command takes effect for packets both delivered by the local device and processed by the CPU.

The load-balance command can also be used for MPLS packets.

If an LPU is not in position, the undo load-balance packet [ all | slot slot-id ] command cannot be used to delete the configurations of this LPU.

A socket monitor monitors and records each connection. A RawLink monitor also monitors interfaces. The socket monitor records specific protocol events that occur during operations and logs information in the disk space.

You can specify the task ID and socket ID for deleting information about the socket monitor that meets the filtering condition.

This command clears statistics on the dual receive buffer of the socket and restarts the count. Therefore, confirm your action before running the command.

To collect IP traffic statistics on an interface in a period of time, you must clear the existing traffic statistics and collect IP statistics after a period of time. Run the display ip statistics command to display information.

If no parameter is specified, the command clears IP traffic statistics on all boards.

You need to clear the existing statistics about RawIP packets before using the display rawip statistics command to view the statistics about RawIP packets in a specified period.

The reset rawip statistics command clears RawIP packet statistics. Confirm your action before running this command.

Usage Scenario

To delete TCP packet statistics, run the reset tcp statistics command. To view TCP packet statistics, run the display tcp statistics [ verbose ] command. The command output contains the number of sent packets, the number of received packets, or the number of TCP packets for each protocol (verbose). You can run the reset tcp statistics command to delete existing statistics and then run the display tcp statistics command to collect statistics. The statistics help you check whether TCP packet counts are correct or help you diagnose faults.

Precautions

The reset tcp statistics command deletes TCP traffic statistics. Confirm your action before running this command.

Usage Scenario

To delete UDP packet statistics, run the reset udp statistics command. To view UDP packet statistics, run the display udp statistics [ verbose ] command. The command output contains the number of sent packets, the number of received packets, or the number of UDP packets for each protocol (verbose). You can run the reset udp statistics command to delete existing statistics and then run the display udp statistics command to collect statistics. The statistics help you check whether UDP packet counts are correct or help you diagnose faults.

Precautions

The reset udp statistics command deletes UDP traffic statistics. Confirm your action before running this command.

Usage Scenario

You can run the set priority command to set the 802.1p priority or DSCP priority of packets sent by the switch.

To change the DSCP priority of protocol packets that meet specified characteristics and are sent by the switch, you can use an ACL to match these packets.

Precautions

If the packet priority has been specified in the protocol, the set priority 8021p command does not take effect.

If you use ACLs to match packets whose DSCP priority is to be changed, you can specify up to eight ACLs, each of which supports a maximum of 32 rules. The following fields can be matched:

• ICMP packets: source IP address, destination IP address, protocol number, icmp-type, icmp-code, fragment, precedence, tos, dscp, ttl-expired, vpn-instance, and time-range

• TCP packets: source IP address, destination IP address, protocol number, source port, destination port, tcp-flag, fragment, precedence, tos, dscp, ttl-expired, vpn-instance, and time-range

• UDP packets: source IP address, destination IP address, protocol number, source port, destination port, fragment, precedence, tos, dscp, ttl-expired, vpn-instance, and time-range

• Other protocol packets: source IP address, destination IP address, protocol number, fragment, precedence, tos, dscp, ttl-expired, vpn-instance, and time-range

The switch cannot use ACL-based matching to change the DSCP priority of the following protocol packets:

• Protocol packets that are not sent from the protocol stack, such as fast ICMP reply packets and NetStream packets

• Protocol packets whose priority can be configured using a command (for example, you can run the tos command to set the priority of NQA packets)

When the trap function is enabled, the device generates traps during running and sends traps to the NMS through SNMP. When the trap function is not enabled, the device does not generate traps and the SNMP module does not send traps to the NMS.

You can specify trap-name to enable the trap function for one or more events.If you do not specify trap-name, all traps of the IP module will be enabled.

When the trap function is enabled, the device generates traps during running and sends traps to the NMS through SNMP. When the trap function is not enabled, the device does not generate traps and the SNMP module does not send traps to the NMS.

You can specify trap-name to enable the trap function for one or more events.If you do not specify trap-name, all traps of the TCP module will be enabled.

Usage Scenario

To establish a TCP connection, the MSS value is negotiated, which indicates the maximum length of packets that the local device can receive. The TCP client on a network may send a request packet for establishing a TCP connection carrying a small MSS value. For example, the MSS value is 1. After the TCP server receives the request packet carrying the MSS value, the TCP connection is established. The TCP client then may send large numbers of requests to the server by an application, causing the TCP server to generate large numbers of reply packets. This may burden the TCP server or network, causing denial of service (DoS) attacks. To resolve this problem, run the tcp min-mss command to set the minimum MSS value for a TCP connection. This configuration prevents a server from receiving packets carrying a small MSS value.

Precautions

The minimum MSS value configured using this command is not the negotiation parameter value carried in the MSS option. The negotiation parameter value carried in the MSS option of packets sent by the local device is calculated based on the MTU value.

The minimum MSS value configured using the tcp min-mss command must be less than the maximum MSS value configured using the tcp max-mss command.

If the tcp min-mss command is run more than once in the same view, the latest configuration overrides the previous one.

Configure the parameters under the guidance of the technical personnel.

Usage Scenario

To establish a TCP connection, the MSS value is negotiated, which indicates the maximum length of packets that the local device can receive. This length is the TCP payload length, excluding that of the TCP header. If the path MTU is unavailable on one end of a TCP connection, this end cannot adjust the TCP packet size based on the MTU. As a result, this end may send TCP packets that are longer than the MTUs on intermediate devices, which will discard these packets. To prevent this problem, run the tcp max-mss command on either end of a TCP connection to set the maximum MSS value of TCP packets. Then the MSS value negotiated by both ends will not exceed this maximum MSS value, and accordingly TCP packets sent from both ends will not be longer than this maximum MSS value and can travel through the intermediate network.

Precautions

The maximum MSS value configured using the tcp max-mss command must be greater than the minimum MSS value configured using the tcp min-mss command.

When a TCP connection changes from FIN_WAIT_1 to FIN_WAIT_2, the TCP FIN-Wait timer is started. If no response packet is received after the TCP FIN-Wait timer expires, the TCP connection is closed.

If you run this command in the same view for multiple times, only the last configuration takes effect.

You are advised to configure this parameter under the supervision of technical support personnel.

When an SYN packet is sent, the TCP SYN-Wait timer is started. If no response packet is received after the TCP SYN-Wait timer expires, the TCP connection is closed.

If you run this command in the same view for multiple times, only the last configuration takes effect.

You are advised to configure this parameter under the supervision of technical support personnel.

If you run this command in the same view for multiple times, only the last configuration takes effect.

You are advised to configure this parameter under the supervision of technical support personnel.