D-Link DWS-4026 Product Manual - Page 78

D-Link Unified Access System Software User Manual 12/10/09 DENIAL OF SERVICE PROTECTION Use the Denial of Service (DoS) page to configure DoS control. D-Link software provides support for classifying and blocking specific types of DoS attacks. You can configure your system to monitor and block these types of attacks: • SIP=DIP: Source IP address = Destination IP address. • First Fragment: TCP Header size smaller then configured value. • TCP Fragment: IP Fragment Offset = 1. • TCP Flag: TCP Flag SYN set and Source Port < 1024 or TCP Control Flags = 0 and TCP Sequence Number = 0 or TCP Flags FIN, URG, and PSH set and TCP Sequence Number = 0 or TCP Flags SYN and FIN set. • L4 Port: Source TCP/UDP Port = Destination TCP/UDP Port. • ICMP: Limiting the size of ICMP Ping packets. To access the Denial of Service page, click LAN > Administration > Denial of Service Protection in the navigation menu. Figure 26: Denial of Service Table 19: Denial of Service Configuration Fields Field Denial of Service First Fragment Denial of Service Min TCP Hdr Size Denial of Service ICMP Description Enable or disable this option by selecting the corresponding line on the pulldown entry field. Enabling First Fragment DoS prevention causes the switch to drop packets that have a TCP header smaller then the configured Min TCP Hdr Size. The factory default is disabled. Specify the Min TCP Hdr Size allowed. If First Fragment DoS prevention is enabled, the switch will drop packets that have a TCP header smaller then this configured Min TCP Hdr Size. The factory default is disabled. Enable or disable this option by selecting the corresponding line on the pulldown entry field. Enabling ICMP DoS prevention causes the switch to drop ICMP packets that have a type set to ECHO_REQ (ping) and a size greater than the configured ICMP Pkt Size. The factory default is disabled. Page 78 Denial of Service Protection Document 34CSFP6XXUWS-SWUM100-D7