Home » TP-Link Manuals » Hubs & Switches » TP-Link T1700X-16TS » Manual Viewer

TP-Link T1700X-16TS T1700X-16TSUN V1 User Guide - Page 210

DoS Attack Type, Description

View all TP-Link T1700X-16TS manuals

Add to My Manuals
Save this manual to your list of manuals

Page 210 highlights

the illegal packets directly and limit the transmission rate of the legal packets if the over legal packets may incur a breakdown of the network. The switch can defend several types of DoS attack listed in the following table. DoS Attack Type Description Land Attack The attacker sends a specific fake SYN packet to the destination Host. Since both the source IP address and the destination IP address of the SYN packet are set to be the IP address of the Host, the Host will be trapped in an endless circle for building the initial connection. The performance of the network will be reduced extremely. Scan SYNFIN The attacker sends the packet with its SYN field and the FIN field set to 1. The SYN field is used to request initial connection whereas the FIN field is used to request disconnection. Therefore, the packet of this type is illegal. The switch can defend this type of illegal packet. Xmascan The attacker sends the illegal packet with its TCP index, FIN, URG and PSH field set to 1. NULL Scan Attack The attacker sends the illegal packet with its TCP index and all the control fields set to 0. During the TCP connection and data transmission, the packets with all the control fields set to 0 are considered as the illegal packets. SYN packet with its The attacker sends the illegal packet with its TCP SYN field set to 1 source port less than and source port less than 1024. 1024 Blat Attack The attacker sends the illegal packet with its source port and destination port on Layer 4 the same and its URG field set to 1. Similar to the Land Attack, the system performance of the attacked Host is reduced since the Host circularly attempts to build a connection with the attacker. Ping Flooding The attacker floods the destination system with Ping broadcast storm packets to forbid the system to respond to the legal communication. SYN/SYN-ACK Flooding The attacker uses a fake IP address to send TCP request packets to the Server. Upon receiving the request packets, the Server responds with SYN-ACK packets. Since the IP address is fake, no response will be returned. The Server will keep on sending SYN-ACK packets. If the attacker sends overflowing fake request packets, the network resource will be occupied maliciously and the requests of the legal clients will be denied. WinNuke Attack Since the Operation System with bugs cannot correctly process the URG (Urgent Pointer) of TCP packets, the attacker sends this type of packets to the TCP port139 (NetBIOS) of the Host with the Operation System bugs, which will cause the Host with a blue screen. Table 12-1 Defendable DoS Attack Types 199

Section	Page
Package Contents	12
Chapter 1 About this Guide	13
1.1 Intended Readers	13
1.2 Conventions	13
1.3 Overview of This Guide	13
Chapter 2 Introduction	17
2.1 Overview of the Switch	17
2.2 Appearance Description	17
2.2.1 Front Panel	17
2.2.2 Rear Panel	18
Chapter 3 Login to the Switch	20
3.1 Login	20
3.2 Configuration	21
Chapter 4 System	22
4.1 System Info	22
4.1.1 System Summary	22
4.1.2 Device Description	23
4.1.3 System Time	24
4.1.4 Daylight Saving Time	25
4.1.5 System IPv6	26
4.2 User Management	35
4.2.1 User Table	35
4.2.2 User Config	35
4.3 System Tools	36
4.3.1 Boot Config	37
4.3.2 Config Restore	38
4.3.3 Config Backup	38
4.3.4 Firmware Upgrade	39
4.3.5 System Reboot	40
4.3.6 System Reset	40
4.4 Access Security	41
4.4.1 Access Control	41
4.4.2 HTTP Config	42
4.4.3 HTTPS Config	43
4.4.4 SSH Config	45
4.4.5 Telnet Config	52
Chapter 5 Switching	53
5.1 Port	53
5.1.1 Port Config	53
5.1.2 Port Mirror	54
5.1.3 Port Security	56
5.1.4 Port Isolation	58
5.1.5 Loopback Detection	59
5.2 LAG	61
5.2.1 LAG Table	62
5.2.2 Static LAG	63
5.2.3 LACP Config	64
5.3 Traffic Monitor	66
5.3.1 Traffic Summary	66
5.3.2 Traffic Statistics	67
5.4 MAC Address	68
5.4.1 Address Table	69
5.4.2 Static Address	70
5.4.3 Dynamic Address	72
5.4.4 Filtering Address	73
Chapter 6 VLAN	75
6.1 802.1Q VLAN	76
6.1.1 VLAN Config	77
6.1.2 Port Config	78
6.2 Application Example for 802.1Q VLAN	80
6.3 MAC VLAN	81
6.3.1 MAC VLAN	82
6.3.2 Port Enable	82
6.4 Application Example for MAC VLAN	83
6.5 Protocol VLAN	85
6.5.1 Protocol Group Table	86
6.5.2 Protocol Group	86
6.5.3 Protocol Template	87
6.6 Application Example for Protocol VLAN	89
6.7 Private VLAN	90
6.7.1 PVLAN Config	92
6.7.2 Port Config	93
6.8 Application Example for Private VLAN	94
Chapter 7 Spanning Tree	97
7.1 STP Config	102
7.1.1 STP Config	102
7.1.2 STP Summary	104
7.2 Port Config	105
7.3 MSTP Instance	107
7.3.1 Region Config	107
7.3.2 Instance Config	107
7.3.3 Instance Port Config	108
7.4 STP Security	110
7.4.1 Port Protect	110
7.4.2 TC Protect	113
7.5 Application Example for STP Function	113
Chapter 8 Multicast	118
8.1 IGMP Snooping	122
8.1.1 Snooping Config	124
8.1.2 Port Config	125
8.1.3 VLAN Config	126
8.1.4 Multicast VLAN	127
8.1.5 Querier Config	130
8.1.6 Profile Config	132
8.1.7 Profile Binding	133
8.1.8 Packet Statistics	135
8.2 MLD Snooping	136
8.2.1 Snooping Config	138
8.2.2 Port Config	139
8.2.3 VLAN Config	140
8.2.4 Multicast VLAN	141
8.2.5 Querier Config	143
8.2.6 Profile Config	144
8.2.7 Profile Binding	146
8.2.8 Packet Statistics	148
8.3 Multicast Table	149
8.3.1 IPv4 Multicast Table	149
8.3.2 Static IPv4 Multicast Table	150
8.3.3 IPv6 Multicast Table	151
8.3.4 Static IPv6 Multicast Table	152
Chapter 9 Routing	154
9.1 Interface	154
9.2 Routing Table	157
9.3 Static Routing	158
9.4 ARP	159
9.4.1 ARP Table	159
9.4.2 Static ARP	159
Chapter 10 QoS	161
10.1 DiffServ	164
10.1.1 Port Priority	164
10.1.2 Schedule Mode	165
10.1.3 802.1P Priority	166
10.1.4 DSCP Priority	167
10.2 Bandwidth Control	169
10.2.1 Rate Limit	169
10.2.2 Storm Control	170
10.3 Voice VLAN	171
10.3.1 Global Config	173
10.3.2 Port Config	174
10.3.3 OUI Config	175
Chapter 11 ACL	178
11.1 ACL Config	178
11.1.1 ACL Summary	178
11.1.2 ACL Create	178
11.1.3 MAC ACL	179
11.1.4 Standard-IP ACL	180
11.1.5 Extend-IP ACL	181
11.2 Policy Config	182
11.2.1 Policy Summary	182
11.2.2 Policy Create	182
11.2.3 Action Create	183
11.3 ACL Binding	183
11.3.1 Binding Table	184
11.3.2 Port Binding	185
11.3.3 VLAN Binding	186
11.4 Policy Binding	186
11.4.1 Binding Table	187
11.4.2 Port Binding	188
11.4.3 VLAN Binding	189
11.5 Application Example for ACL	189
Chapter 12 Network Security	192
12.1 IP-MAC Binding	192
12.1.1 Binding Table	192
12.1.2 Manual Binding	193
12.1.3 ARP Scanning	195
12.2 DHCP Snooping	196
12.2.1 Global Config	200
12.2.2 Port Config	201
12.3 ARP Inspection	202
12.3.1 ARP Detect	206
12.3.2 ARP Defend	207
12.3.3 ARP Statistics	208
12.4 DoS Defend	209
12.4.1 DoS Defend	211
12.5 802.1X	211
12.5.1 Global Config	215
12.5.2 Port Config	217
12.5.3 RADIUS Config	218
Chapter 13 SNMP	220
13.1 SNMP Config	222
13.1.1 Global Config	222
13.1.2 SNMP View	223
13.1.3 SNMP Group	224
13.1.4 SNMP User	225
13.1.5 SNMP Community	227
13.2 Notification	229
13.3 RMON	231
13.3.1 Statistics	232
13.3.2 History	233
13.3.3 Event	234
13.3.4 Alarm	235
Chapter 14 LLDP	237
14.1 Basic Config	241
14.1.1 Global Config	241
14.1.2 Port Config	242
14.2 Device Info	243
14.2.1 Local Info	243
14.2.2 Neighbor Info	244
14.3 Device Statistics	245
14.4 LLDP-MED	247
14.4.1 Global Config	248
14.4.2 Port Config	248
14.4.3 Local Info	251
14.4.4 Neighbor Info	252
Chapter 15 Maintenance	253
15.1 System Monitor	253
15.1.1 CPU Monitor	253
15.1.2 Memory Monitor	254
15.2 Log	254
15.2.1 Log Table	255
15.2.2 Local Log	256
15.2.3 Remote Log	257
15.2.4 Backup Log	257
15.3 Device Diagnostics	258
15.3.1 Cable Test	258
15.4 Network Diagnostics	259
15.4.1 Ping	260
15.4.2 Tracert	260
Appendix A: Specifications	262

Match case Limit results 1 per page

the illegal packets directly and limit the transmission rate of the legal packets if the over legal

packets may incur a breakdown of the network. The switch can defend several types of DoS attack

listed in the following table.

DoS Attack Type

Description

Land Attack

The attacker sends a specific fake SYN packet to the destination Host.

Since both the source IP address and the destination IP address of the

SYN packet are set to be the IP address of the Host, the Host will be

trapped in an endless circle for building the initial connection. The

performance of the network will be reduced extremely.

Scan SYNFIN

The attacker sends the packet with its SYN field and the FIN field set to

1. The SYN field is used to request initial connection whereas the FIN

field is used to request disconnection. Therefore, the packet of this

type is illegal. The switch can defend this type of illegal packet.

Xmascan

The attacker sends the illegal packet with its TCP index, FIN, URG and

PSH field set to 1.

NULL Scan Attack

The attacker sends the illegal packet with its TCP index and all the

control fields set to 0. During the TCP connection and data

transmission, the packets with all the control fields set to 0 are

considered as the illegal packets.

SYN packet with its

source port less than

1024

The attacker sends the illegal packet with its TCP SYN field set to 1

and source port less than 1024.

Blat Attack

The attacker sends the illegal packet with its source port and

destination port on Layer 4 the same and its URG field set to 1. Similar

to the Land Attack, the system performance of the attacked Host is

reduced since the Host circularly attempts to build a connection with

the attacker.

Ping Flooding

The attacker floods the destination system with Ping broadcast storm

packets to forbid the system to respond to the legal communication.

SYN/SYN-ACK

Flooding

The attacker uses a fake IP address to send TCP request packets to

the Server. Upon receiving the request packets, the Server responds

with SYN-ACK packets. Since the IP address is fake, no response will

be returned. The Server will keep on sending SYN-ACK packets. If the

attacker sends overflowing fake request packets, the network resource

will be occupied maliciously and the requests of the legal clients will be

denied.

WinNuke Attack

Since the Operation System with bugs cannot correctly process the

URG (Urgent Pointer) of TCP packets, the attacker sends this type of

packets to the TCP port139 (NetBIOS) of the Host with the Operation

System bugs, which will cause the Host with a blue screen.

Table 12-1 Defendable DoS Attack Types

199