Dell FCX624-E Laptop User Manual


  Open as PDF
of 1494
 
1340 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Protecting against Smurf attacks
38
For each ICMP echo request packet sent by the attacker, a number of ICMP replies equal to the
number of hosts on the intermediary network are sent to the victim. If the attacker generates a
large volume of ICMP echo request packets, and the intermediary network contains a large number
of hosts, the victim can be overwhelmed with ICMP replies.
Avoiding being an intermediary in a Smurf attack
A Smurf attack relies on the intermediary to broadcast ICMP echo request packets to hosts on a
target subnet. When the ICMP echo request packet arrives at the target subnet, it is converted to a
Layer 2 broadcast and sent to the connected hosts. This conversion takes place only when
directed broadcast forwarding is enabled on the device.
To avoid being an intermediary in a Smurf attack, make sure forwarding of directed broadcasts is
disabled on the Dell PowerConnect device. Directed broadcast forwarding is disabled by default. To
disable directed broadcast forwarding, do one of the following.
PowerConnect(config)#no ip directed-broadcast
Syntax: [no] ip directed-broadcast
Avoiding being a victim in a Smurf attack
You can configure the Dell PowerConnect device to drop ICMP packets when excessive numbers
are encountered, as is the case when the device is the victim of a Smurf attack. You can set
threshold values for ICMP packets that are targeted at the router itself or passing through an
interface, and drop them when the thresholds are exceeded.
For example, to set threshold values for ICMP packets targeted at the router, enter the following
command in global CONFIG mode.
PowerConnect(config)#ip icmp burst-normal 5000 burst-max 10000 lockup 300
To set threshold values for ICMP packets received on interface 3/11, enter the following
commands.
PowerConnect(config)#interface ethernet 3/11
PowerConnect(config-if-e1000-3/11)#ip icmp burst-normal 5000 burst-max 10000
lockup 300
For Layer 3 router code, if the interface is part of a VLAN that has a router VE, you must configure
ICMP attack protection at the VE level. Otherwise, you can configure this feature at the interface
level as shown in the previous example. When ICMP attack protection is configured at the VE level,
it will apply to routed traffic only. It will not affect switched traffic.
NOTE
You must configure VLAN information for the port before configuring ICMP attack protection. You
cannot change the VLAN configuration for a port on which ICMP attack protection is enabled.
To set threshold values for ICMP packets received on VE 31, enter commands such as the
following.
PowerConnect(config)#interface ve 31
PowerConnect(config-vif-31)#ip icmp burst-normal 5000 burst-max 10000 lockup 300
Syntax: ip icmp burst-normal <value> burst-max <value> lockup <seconds>
The burst-normal <value> parameter can be from 1 through 100,000 packets per second.