Home » TP-Link Manuals » Hubs & Switches » TP-Link T3700G-28TQ » Manual Viewer

TP-Link T3700G-28TQ T3700G-28TQ V1 UG - Page 304

DoS Defend, DoS Attack Type, Description

View all TP-Link T3700G-28TQ manuals

Add to My Manuals
Save this manual to your list of manuals

Page 304 highlights

14.5 DoS Defend DoS (Denial of Service) Attack is to occupy the network bandwidth maliciously by the network attackers or the evil programs sending a lot of service requests to the Host, which incurs an abnormal service or even breakdown of the network. With DoS Defend function enabled, the switch can analyze the specific fields of the IP packets and distinguish the malicious DoS attack packets. Upon detecting the packets, the switch will discard the illegal packets directly and limit the transmission rate of the legal packets if the over legal packets may incur a breakdown of the network. The switch can defend several types of DoS attack listed in the following table. DoS Attack Type Description Land Attack The attacker sends a specific fake SYN packet to the destination Host. Since both the source IP address and the destination IP address of the SYN packet are set to be the IP address of the Host, the Host will be trapped in an endless circle for building the initial connection. The performance of the network will be reduced extremely. Scan SYNFIN The attacker sends the packet with its SYN field and the FIN field set to 1. The SYN field is used to request initial connection whereas the FIN field is used to request disconnection. Therefore, the packet of this type is illegal. The switch can defend this type of illegal packet. Xmascan The attacker sends the illegal packet with its TCP index, FIN, URG and PSH field set to 1. NULL Scan Attack The attacker sends the illegal packet with its TCP index and all the control fields set to 0. During the TCP connection and data transmission, the packets with all the control fields set to 0 are considered as the illegal packets. SYN packet with its The attacker sends the illegal packet with its TCP SYN field set to 1 source port less than and source port less than 1024. 1024 Blat Attack The attacker sends the illegal packet with its source port and destination port on Layer 4 the same and its URG field set to 1. Similar to the Land Attack, the system performance of the attacked Host is reduced since the Host circularly attempts to build a connection with the attacker. Ping Flooding The attacker floods the destination system with Ping broadcast storm packets to forbid the system to respond to the legal communication. SYN/SYN-ACK Flooding The attacker uses a fake IP address to send TCP request packets to the Server. Upon receiving the request packets, the Server responds with SYN-ACK packets. Since the IP address is fake, no response will be returned. The Server will keep on sending SYN-ACK packets. If the attacker sends overflowing fake request packets, the network resource will be occupied maliciously and the requests of the legal clients will be denied. Table 14-1 Defendable DoS Attack Types 293

Section	Page
Package Contents	12
Chapter 1 About This Guide	13
1.1 Intended Readers	13
1.2 Conventions	13
1.3 Overview of This Guide	13
Chapter 2 Introduction	18
2.1 Overview of the Switch	18
2.2 Main Features	18
2.3 Appearance Description	19
2.3.1 Front Panel	19
2.3.2 Rear Panel	21
Chapter 3 Login to the Switch	23
3.1 Login	23
3.2 Configuration	23
Chapter 4 System	25
4.1 System Info	25
4.1.1 System Summary	25
4.1.2 Device Description	27
4.1.3 System Time	28
4.1.4 Daylight Saving Time	29
4.2 User Management	30
4.2.1 User Table	30
4.2.2 User Config	30
4.3 System Tools	32
4.3.1 Boot Config	32
4.3.2 Config Restore	33
4.3.3 Config Backup	33
4.3.4 Firmware Upgrade	34
4.3.5 System Reboot	35
4.3.6 System Reset	35
4.4 Access Security	35
4.4.1 Access Control	35
4.4.2 SSL Config	37
4.4.3 SSH Config	38
Chapter 5 Stack	44
5.1 Stack Management	50
5.1.1 Stack Info	50
5.1.2 Stack Config	51
5.1.3 Switch Renumber	52
5.2 Application Example for Stack	53
Chapter 6 Switching	55
6.1 Port	55
6.1.1 Port Config	55
6.1.2 Port Mirror	56
6.1.3 Port Security	58
6.1.4 Port Isolation	60
6.2 LAG	61
6.2.1 LAG Table	62
6.2.2 Static LAG	63
6.2.3 LACP Config	64
6.3 Traffic Monitor	66
6.3.1 Traffic Summary	66
6.3.2 Traffic Statistics	68
6.4 MAC Address	70
6.4.1 Address Table	70
6.4.2 Static Address	72
6.4.3 Dynamic Address	73
6.4.4 Filtering Address	75
Chapter 7 VLAN	77
7.1 802.1Q VLAN	78
7.1.1 VLAN Config	79
7.1.2 Port Config	81
7.2 Application Example for 802.1Q VLAN	83
7.3 MAC VLAN	84
7.3.1 MAC VLAN	84
7.3.2 Port Enable	85
7.4 Application Example for MAC VLAN	86
7.5 Protocol VLAN	88
7.5.1 Protocol Group Table	88
7.5.2 Protocol Group	89
7.5.3 Protocol Template	90
7.6 Application Example for Protocol VLAN	91
7.7 VLAN VPN	93
7.7.1 VPN Config	94
7.7.2 Port Enable	94
7.7.3 VLAN Mapping	95
7.8 GVRP	97
7.9 Private VLAN	100
7.9.1 PVLAN Config	102
7.9.2 Port Config	103
7.10 Application Example for Private VLAN	104
Chapter 8 Spanning Tree	107
8.1 STP Config	112
8.1.1 STP Config	112
8.1.2 STP Summary	114
8.2 Port Config	114
8.3 MSTP Instance	116
8.3.1 Region Config	116
8.3.2 Instance Config	117
8.3.3 Instance Port Config	118
8.4 STP Security	120
8.4.1 Port Protect	120
8.4.2 TC Protect	122
8.5 Application Example for STP Function	123
Chapter 9 Multicast	127
9.1 IGMP Snooping	129
9.1.1 Snooping Config	130
9.1.2 Port Config	131
9.1.3 VLAN Config	132
9.1.4 Multicast VLAN	134
9.1.5 Querier Config	136
9.2 Application Example for Multicast VLAN	138
9.3 Multicast IP	140
9.3.1 Multicast IP Table	140
9.3.2 Static Multicast IP	140
9.4 Multicast Filter	142
9.4.1 Profile Config	142
9.4.2 Profile Binding	143
9.5 Packet Statistics	144
Chapter 10 Routing	146
10.1 Interface	146
10.2 Routing Table	149
10.3 Static Routing	149
10.4 DHCP Server	150
10.4.1 DHCP Server	156
10.4.2 Pool Setting	158
10.4.3 Manual Binding	159
10.4.4 Binding Table	159
10.4.5 Packet Statistics	160
10.5 DHCP Relay	161
10.5.1 Global Config	163
10.5.2 DHCP Server	164
10.6 Proxy ARP	165
10.7 ARP	167
10.8 RIP	168
10.8.1 Basic Config	171
10.8.2 Interface Config	173
10.8.3 RIP Database	174
10.8.4 Application Example for RIP	175
10.9 OSPF	176
10.9.1 Process	193
10.9.2 Basic	193
10.9.3 Network	196
10.9.4 Interface	197
10.9.5 Area	200
10.9.6 Area Aggregation	202
10.9.7 Virtual Link	203
10.9.8 Route Redistribution	205
10.9.9 ASBR Aggregation	206
10.9.10 Neighbor Table	207
10.9.11 Link State Database	208
10.10 VRRP	209
10.10.1 Basic Config	213
10.10.2 Advanced Config	215
10.10.3 Virtual IP Config	216
10.10.4 Track Config	217
10.10.5 Virtual Router Statistics	219
Chapter 11 Multicast Routing	221
11.1 Global Config	222
11.1.1 Global Config	222
11.1.2 Mroute Table	222
11.2 IGMP	224
11.2.1 Interface Config	228
11.2.2 Interface State	229
11.2.3 Static Multicast Config	230
11.2.4 Multicast Group Table	232
11.2.5 Profile Binding	233
11.2.6 Packet Statistics	235
11.3 PIM DM	235
11.3.1 PIM DM Interface	240
11.3.2 PIM DM Neighbor	241
11.4 PIM SM	242
11.4.1 PIM SM Interface	247
11.4.2 PIM SM Neighbor	248
11.4.3 BSR	249
11.4.4 RP	250
11.4.5 RP Mapping	251
11.4.6 RP Info	252
11.5 Static Mroute	253
11.5.1 Static Mroute Config	254
11.5.2 Static Mroute Table	255
Chapter 12 QoS	256
12.1 DiffServ	259
12.1.1 Port Priority	259
12.1.2 Schedule Mode	260
12.1.3 802.1P Priority	261
12.1.4 DSCP Priority	262
12.2 Bandwidth Control	264
12.2.1 Rate Limit	264
12.2.2 Storm Control	265
12.3 Voice VLAN	266
12.3.1 Global Config	268
12.3.2 Port Config	269
12.3.3 OUI Config	270
Chapter 13 ACL	272
13.1 Time-Range	272
13.1.1 Time-Range Summary	272
13.1.2 Time-Range Create	273
13.1.3 Holiday Config	274
13.2 ACL Config	274
13.2.1 ACL Summary	275
13.2.2 ACL Create	275
13.2.3 MAC ACL	276
13.2.4 Standard-IP ACL	276
13.2.5 Extend-IP ACL	277
13.3 Policy Config	279
13.3.1 Policy Summary	279
13.3.2 Policy Create	279
13.3.3 Action Create	280
13.4 Policy Binding	281
13.4.1 Binding Table	281
13.4.2 Port Binding	282
13.4.3 VLAN Binding	283
13.5 Application Example for ACL	284
Chapter 14 Network Security	286
14.1 IP-MAC Binding	286
14.1.1 Binding Table	286
14.1.2 Manual Binding	287
14.1.3 ARP Scanning	289
14.2 DHCP Snooping	290
14.2.1 Global Config	293
14.2.2 Port Config	295
14.3 ARP Inspection	296
14.3.1 ARP Detect	299
14.3.2 ARP Defend	300
14.3.3 ARP Statistics	301
14.4 IP Source Guard	302
14.5 DoS Defend	304
14.5.1 DoS Defend	305
14.6 802.1X	305
14.6.1 Global Config	309
14.6.2 Port Config	311
14.6.3 Radius Server	312
Chapter 15 SNMP	314
15.1 SNMP Config	316
15.1.1 Global Config	316
15.1.2 SNMP View	317
15.1.3 SNMP Group	317
15.1.4 SNMP User	319
15.1.5 SNMP Community	321
15.2 Notification	323
15.3 RMON	324
15.3.1 Statistics	325
15.3.2 History	326
15.3.3 Event	327
15.3.4 Alarm	327
Chapter 16 LLDP	330
16.1 Basic Config	333
16.1.1 Global Config	333
16.1.2 Port Config	334
16.2 Device Info	335
16.2.1 Local Info	335
16.2.2 Neighbor Info	337
16.3 Device Statistics	338
16.4 LLDP-MED	339
16.4.1 Global Config	340
16.4.2 Port Config	341
16.4.3 Local Info	343
16.4.4 Neighbor Info	344
Chapter 17 Cluster	346
17.1 NDP	347
17.1.1 Neighbor Info	347
17.1.2 NDP Summary	348
17.1.3 NDP Config	349
17.2 NTDP	350
17.2.1 Device Table	350
17.2.2 NTDP Summary	352
17.2.3 NTDP Config	353
17.3 Cluster	354
17.3.1 Cluster Summary	354
17.3.2 Cluster Config	357
17.3.3 Member Config	360
17.3.4 Cluster Topology	361
17.4 Application Example for Cluster Function	363
Chapter 18 Maintenance	365
18.1 System Monitor	365
18.1.1 CPU Monitor	365
18.1.2 Memory Monitor	366
18.2 Log	367
18.2.1 Log Table	368
18.2.2 Local Log	369
18.2.3 Remote Log	370
18.2.4 Backup Log	370
18.3 Device Diagnostics	371
18.3.1 Cable Test	371
18.3.2 Loopback	372
18.4 Network Diagnostics	373
18.4.1 Ping	373
18.4.2 Tracert	374
Chapter 19 System Maintenance via FTP	375
Appendix A: Specifications	381
Appendix B: Configuring the PCs	383
Appendix C: 802.1X Client Software	385

Match case Limit results 1 per page

14.5 DoS Defend

DoS (Denial of Service) Attack is to occupy the network bandwidth maliciously by the network

attackers or the evil programs sending a lot of service requests to the Host, which incurs an

abnormal service or even breakdown of the network.

With DoS Defend function enabled, the switch can analyze the specific fields of the IP packets and

distinguish the malicious DoS attack packets. Upon detecting the packets, the switch will discard

the illegal packets directly and limit the transmission rate of the legal packets if the over legal

packets may incur a breakdown of the network. The switch can defend several types of DoS attack

listed in the following table.

DoS Attack Type

Description

Land Attack

The attacker sends a specific fake SYN packet to the destination Host.

Since both the source IP address and the destination IP address of the

SYN packet are set to be the IP address of the Host, the Host will be

trapped in an endless circle for building the initial connection. The

performance of the network will be reduced extremely.

Scan SYNFIN

The attacker sends the packet with its SYN field and the FIN field set to

1. The SYN field is used to request initial connection whereas the FIN

field is used to request disconnection. Therefore, the packet of this

type is illegal. The switch can defend this type of illegal packet.

Xmascan

The attacker sends the illegal packet with its TCP index, FIN, URG and

PSH field set to 1.

NULL Scan Attack

The attacker sends the illegal packet with its TCP index and all the

control fields set to 0. During the TCP connection and data

transmission, the packets with all the control fields set to 0 are

considered as the illegal packets.

SYN packet with its

source port less than

1024

The attacker sends the illegal packet with its TCP SYN field set to 1

and source port less than 1024.

Blat Attack

The attacker sends the illegal packet with its source port and

destination port on Layer 4 the same and its URG field set to 1. Similar

to the Land Attack, the system performance of the attacked Host is

reduced since the Host circularly attempts to build a connection with

the attacker.

Ping Flooding

The attacker floods the destination system with Ping broadcast storm

packets to forbid the system to respond to the legal communication.

SYN/SYN-ACK

Flooding

The attacker uses a fake IP address to send TCP request packets to

the Server. Upon receiving the request packets, the Server responds

with SYN-ACK packets. Since the IP address is fake, no response will

be returned. The Server will keep on sending SYN-ACK packets. If the

attacker sends overflowing fake request packets, the network resource

will be occupied maliciously and the requests of the legal clients will be

denied.

Table 14-1 Defendable DoS Attack Types

293