Configuring the Threshold for Attack Source Tracing
Context
Attackers may send a large number of packets to attack network devices' CPUs. You can configure attack source tracing and set an alarm threshold for attack source tracing so that the device can analyze packets sent to the CPU. If the number of protocol packets sent from an attack source in a specified period exceeds the alarm threshold, the device sends logs or alarms to notify the administrator so that the administrator can take measures to prevent attacks.
Procedure
- Run system-view
The system view is displayed.
- Run cpu-defend policy policy-name
The attack defense policy view is displayed.
- Run auto-defend enable
Attack source tracing is enabled.
By default, attack source tracing is disabled.
- Run auto-defend threshold threshold
The checking threshold for attack source tracing is set.
By default, the checking threshold for attack source tracing is 128 pps.
- Run commit
The configuration is committed.