cpu-defend host-car pps
Function
The cpu-defend host-car pps command sets the rate limit for the user-level rate limiting.
The undo cpu-defend host-car command restores the default rate limit for the user-level rate limiting.
By default, the rate limit for the user-level rate limiting is 10 pps.
Only the S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-HI, S6730-H, S6730S-H, S6730-S, and S6730S-S support this command.
Format
cpu-defend host-car [ mac-address mac-address | car-id car-id ] pps pps-value
undo cpu-defend host-car { mac-address mac-address | car-id car-id }
Parameters
| Parameter | Description | Value |
|---|---|---|
| mac-address mac-address | Sets the rate limit for the specified MAC address. | - |
| car-id car-id | Sets the rate limit for the specified bucket. | The value is an integer that ranges from 0 to 8191. |
| pps pps-value | Indicates the rate limit. | The value is an integer that ranges from 1 to 128. |
Usage Guidelines
Usage Scenario
User-level rate limiting identifies users by user MAC addresses and limits the rates of specified packets (ARP, ND, DHCP Request, DHCPv6 Request, IGMP, 802.1X, and HTTPS-SYN packets) for both wired and wireless users. By default, the user-level rate limit is 10 pps. You can set a rate limit based on user.
Precautions
- Before using this command, run the cpu-defend host-car enable command to enable user-level rate limiting.
- If the rate limit is too high, attacks cannot be prevented and CPU may be overloaded.
- If both the cpu-defend host-car mac-address mac-address pps pps-value and cpu-defend host-car pps pps-value commands are run, the rate limit for the specified MAC address is determined by the former command, and the rate limit for other MAC addresses is determined by the latter command.
- The user-level rate limiting performs a hash calculation for the source MAC addresses of specified packets, and places the packets into different buckets. When two user MAC addresses are mapped to the same bucket index, the two users share the same rate limit (in pps mode). If the two users modify the rate limit for the bucket simultaneously, the setting will be overwritten. To avoid this situation, the rate limit for the specified MAC address cannot be set upon hash conflict.
- When the cpu-defend host-car mac-address mac-address pps pps-value and cpu-defend host-car pps pps-value commands are run to configure the rate limit for multiple MAC addresses, the settings are displayed in the alphabetic order in the configuration file.