Configuring Flood Attack Prevention

Context

A large number of packets on a device occupy many network resources, affecting network services. To ensure normal running of network services, you can limit the rate of packets of some protocols (such as DHCP and ARP) on APs with a proper range.

The following table lists the method for limiting the rate of packets.

**Table 1** Method for limiting the rate of packets
Granularity	Description	Configuration
AP-based	Limit the rate of downlink traffic on the AP's wired interface and CAPWAP tunnel. NOTE: The rate of only broadcast and multicast packets is limited, and that of unicast packets is not limited.	Configuring the Rate Limit for Broadcast and Multicast Packets of APs NOTE: The AD9431DN-24X does not support this function.
STA-based	Limit the rate of uplink traffic on the air interface from STAs. NOTE: The rate of unicast, multicast, and broadcast packets can be limited.	Configuring Flood Attack Prevention

Procedure

Run system-view
The system view is displayed.
Run wlan
The WLAN view is displayed.
Run vap-profile name profile-name
The VAP profile view is displayed.
Run undo anti-attack flood { all | arp | dhcp | dhcpv6 | igmp | mdns | nd | other-broadcast | other-multicast } disable
Flood attack prevention is enabled.

By default, the flood prevention function is enabled.
Run anti-attack flood { arp | dhcp | dhcpv6 | igmp | mdns | nd | other-broadcast | other-multicast } sta-rate-threshold sta-rate-threshold
The rate threshold for flood attack prevention is configured.

The default flood threshold is 4 pps for ARP, DHCP, DHCPv6, IGMP, and mDNS packets, 8 pps for ND packets, 10 pps for broadcast packets other than ARP, DHCP, DHCPv6, and ND packets, and 10 pps for multicast packets other than IGMP and mDNS packets.
(Optional) Run anti-attack flood { arp | dhcp | dhcpv6 | igmp | mdns | nd | other-broadcast | other-multicast } blacklist enable
The flood blacklist function is enabled. The device then adds STAs that launch flood attacks to the blacklist.

By default, the flood blacklist function is disabled.