Maintaining Deception

Procedure

• Check the deception status.
  • Run the display deception instance command in any view to check whether the deception process is normal.
  • Run the display deception ip-state [ ip-address ] [ verbose ] command in any view to check whether the IP addresses scanned by the switch are online.
  • Run the display deception arp-proxy command in any view to check the interface IP address of the switch and the target IP addresses in the proxy ARP requests sent to the switch in the online IP address table.
  • Run the display deception arp-request [ source ip-address ] command in any view to check the IP address scanning behavior detected by the switch.
  • Run the display deception syn-connect [ source-ip ip-address ] command in any view to check the TCP port scanning behavior detected by the switch.
  • Run the display deception ip-redirect [ source-ip ip-address ] [ destination-ip ip-address ] [ destination-port port ] command in any view to check information about deceived traffic due to the scanning of offline IP addresses.
  • Run the display deception port-redirect [ source-ip ip-address ] [ destination-ip ip-address ] [ destination-port port ] command in any view to check information about deceived traffic due to the scanning of unopened TCP ports.
  • Run the display deception flow [ slot slot-id ] command in any view to check the deception flow table.
  • Run the display deception config-flow [ slot slot-id ] command in any view to check the configuration flow table.

• Update the deception status.
  • Run the reset deception ip-state command in the user view to update the online status of the IP addresses on the network where the switch resides.
  • Run the reset deception port-redirect [ source-ip ip-address ] [ destination-ip ip-address ] [ destination-port port ] command in the user view to clear information about deceived traffic that scanned unopened TCP ports and stops TCP port deception.
  • Run the reset deception arp-proxy command in the user view to clear the interface IP address of the switch and the target IP addresses in the proxy ARP requests sent to the switch in the online IP address table.
  • Run the reset deception aci command in the user view to update ACI entries.

• Check deception statistics.
  • Run the display deception statistics command in any view to check the deception statistics.

• Clear deception statistics.
  • Run the reset deception statistics command in the user view to clear the deception statistics.