Cisco 7609-S Software Configuration Guide - Page 532

Understanding How DoS Protection Works Chapter 36 Configuring Denial of Service Protection Burst values regulate how many packets can be allowed in a burst. Each allowed packet consumes a token and a token must be available for a packet to be allowed. One token is generated per millisecond. When packets are not coming in, tokens can be accumulated up to the burst value. For example, if the burst value is set to 50, the router can accumulate up to 50 tokens and absorb a burst of 50 packets. This example shows how to rate limit the unicast packets from an ingress ACL bridge result to 50000 packets per second, and 50 packets in burst: Router(config)# mls rate-limit unicast acl input 50000 50 This example shows how to rate limit the unicast packets from an ingress ACL bridge result to the same rate (50000 pps and 50 packets in burst) for egress ACL bridge results: Router(config)# mls rate-limit unicast acl output 50000 50 If the values of the rate limiter are altered on either the ingress or the egress when both are enabled, both values are changed to that new value. In the following example, the output rate is changed to 40000 pps: Router(config)# mls rate-limit unicast acl output 40000 50 When you enter the show mls rate-limit command, both the ACL bridged in and the ACL bridged out display the new value of 40000 pps: Router# show mls rate-limit Rate Limiter Type Status MCAST NON RPF Off MCAST DFLT ADJ On MCAST DIRECT CON Off ACL BRIDGED IN On ACL BRIDGED OUT On IP FEATURES Off ... Packets/s --------100000 40000 40000 Burst ----100 50 50 uRPF Check Failure The uRPF check failure rate limiter allows you to configure a rate for the packets that need to be sent to the MSFC because they failed the uRPF check. The uRPF checks validate that incoming packets on an interface are from a valid source, which minimizes the potential threat of DoS attacks from users using spoofed addresses. When spoofed packets fail the uRPF check, those failures can be sent to the MSFC. The uRPF check rate limiters allow you to rate limit the packets per second that are bridged to the MSFC CPU when a uRPF check failure occurs. This example shows how to rate limit the uRPF check failure packets sent to the MSFC to 100000 pps with a burst of 100 packets: Router(config)# mls rate-limit unicast ip rpf-failure 100000 100 TTL Failure This rate limiter rate limits packets sent to the MSFC because of a time-to-live (TTL) check failure. As indicated by the all keyword in the following example, this rate limiter applies to both multicast and unicast traffic. Note The TTL failure rate limiter is not supported for IPv6 multicast. This example shows how to rate limit the TTL failures to 70000 pps with a burst of 150: Router(config)# mls rate-limit all ttl-failure 70000 150 36-16 Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX OL-4266-08