Cisco 7609-S Software Configuration Guide - Page 525

Chapter 36 Configuring Denial of Service Protection Understanding How DoS Protection Works Ingress or egress ACL-bridged packet cases share a single rate-limiter register. If the feature is turned on, ingress and egress ACLs use the same rate-limiter value. This example shows how to rate limit the unicast packets from an ingress ACL bridge result to 50000 packets per second, and 50 packets in burst: Router(config)# mls rate-limit unicast acl input 50000 50 This example shows how to rate limit the unicast packets from an ingress ACL bridge result to the same rate (50000 pps and 50 packets in burst) for egress ACL bridge results: Router(config)# mls rate-limit unicast acl output 50000 50 If the values of the rate limiter are altered on either the ingress or the egress when both are enabled, both values are changed to that new value. In the following example, the output rate is changed to 40000 pps: Router(config)# mls rate-limit unicast acl output 40000 50 When you enter the show mls rate-limit command, both the ACL bridged in and the ACL bridged out display the new value of 40000 pps: Router# sh mls rate-limit Load for five secs: 0%/0%; one minute: 0%; five minutes: 0% Time source is NTP, 10:32:15.584 PDT Fri Aug 5 2005 Rate Limiter Type ACL BRIDGE IN ACL BRIDGE OUT L3_SEC_FEATURES VACL LOG FIB RECEIVE FIB GLEAN Status ---------Off Off Off Off Off Off Packets/s --------- - FIB (CEF) Receive and FIB Glean Cases (Unicast Only) The FIB receive rate limiter provides the capability to rate limit all packets that contain the MSFC IP address as the destination address. The rate limiters do not discriminate between good frames and bad frames. Note Do not enable the FIB receive rate limiter if you are using CoPP. The FIB receive rate limiter overrides the CoPP policies. This example shows how to rate limit the traffic to 25000 pps with a burst of 60: Router(config)# mls rate-limit unicast cef receive 25000 60 The FIB glean rate limiter does not limit ARP traffic, but provides the capability to rate limit traffic that requires address resolution (ARP) and requires that it be sent to the MSFC. This situation occurs when traffic enters a port and contains the destination of a host on a subnet that is locally connected to the MSFC, but no ARP entry exists for that destination host. In this case, because the MAC address of the destination host will not be answered by any host on the directly connected subnet that is unknown, the "glean" adjacency is hit and the traffic is sent directly to the MSFC for ARP resolution. This rate limiter limits the possibility of an attacker overloading the CPU with such ARP requests. This example shows how to rate limit the rate at which this traffic is sent to the MSFC to 20000 pps and a burst of 60: Router(config)# mls rate-limit unicast cef glean 20000 60 OL-4266-08 Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX 36-9