Avaya BSGx4e CLI Guide de l'utilisateur télécharger pdf (Page 41)

3 Configuration commands Intrusion detection system commands

NN47928-107 41

ids anomaly

This command enables and disables protection against packet fragments

anomalies. Protection can be enabled or disabled for the following

anomalies:

z fragoverlap — The offset of one fragment overlaps the offset of another

fragment. For example, if the offset of the first fragment is 0 and its

length is 800, the offset of the second fragment is 800. If it is less than

800, the second fragment overlaps the first fragment. This condition can

indicate an attack.

z fragoverrun — Triggers when a reassembled fragmented datagram

exceeds the declared IP data length or the maximum datagram length.

By definition, no IP datagram can be larger than 65 535 bytes; systems

that try to process these large datagrams can crash. This type of

fragmented traffic can indicate a denial of service attempt.

z fragtooshort — Triggers when any IP fragment other than the final

fragment is less than 400 bytes, indicating that the fragment is likely to

be intentionally crafted. Small fragments can be used in DOS attacks or

in an attempt to bypass security measures or detections.

Protection against all other anomalies is enabled by default and cannot be

disabled. The following table lists the other anomalies.

Syntax config ids anomaly [fragoverlap|fragoverrun|fragtooshort]

active [no|yes]

Parameters attack fragoverlap|fragoverrun|fragtooshort

Specify the packet fragment anomaly to detect.

fragoverlap — The offset of one fragment

overlaps the offset of another fragment.

fragoverrun — Triggers when a reassembled

fragmented datagram exceeds the declared IP

data length or the maximum datagram length.

Table 4

Packet Anomaly Attacks

IP ICMP TCP RTP

Version Length Header

fragmentation

SSRC ID

TTL

(Time to Live)

Flags

Checksum

Length

Options

1 2 ... 36 37 38 39 40 41 42 43 44 45 46 ... 183 184

Pas de commentaire

Avaya BSGx4e CLI Guide de l'utilisateur Page 41