Configuring an Attack Source Tracing Mode

Context

After attack source tracing is enabled, you need to set a mode in which the device traces attack sources. The device supports the following attack source tracing modes:

Source IP address-based tracing: prevents Layer 3 attack packets.
Source MAC address-based tracing: prevents Layer 2 attack packets with a fixed source MAC address.
Tracing based on a combination of source port and VLAN: prevents Layer 2 attack packets with different source MAC addresses.

Procedure

Run system-view
The system view is displayed.
Run cpu-defend policy policy-name
The attack defense policy view is displayed.
Run auto-defend trace-type { source-ip | source-mac | source-portvlan } ^*
The attack source tracing mode is specified.

By default, attack source tracing is based on source IP addresses and source MAC addresses.

When the attack source tracing mode is source-ip and action is error-down, if multiple interfaces receive the attack packets with the same source IP address and the packet rate exceeds the threshold, the switch shuts down only one interface, and then checks packet rate again. If the packet rate is still higher than the threshold, the switch shuts down another interface. The switch repeats the operations until the packet rate falls below the threshold.