chasten redirect-packet

Function

The chasten redirect-packet command restricts the number of HTTPS redirection packets that can be sent as a reply within a specified period.

The undo chasten redirect-packet command restores the default configuration.

By default, the number of HTTPS redirect packet send is 300, the period of HTTPS redirect packet send is 30 seconds, the period of HTTPS blocked is 30 seconds, the TCP SYN packet processing rate in blocking state is 1 per second

This command is supported only on the NetEngine 8000 F1A.

Format

chasten redirect-packet send-number send-period blocking-period blocking-rate

undo chasten redirect-packet send-number send-period blocking-period blocking-rate

Parameters

Parameter	Description	Value
redirect-packet send-number	Specifies the number of response redirection packets.	The value is an integer ranging from 1 to 10000.
redirect-packet send-period	Specifies the time for responding to redirection packets.	The value is an integer ranging from 1 to 3600, in seconds.
redirect-packet blocking-period	Specifies the block time for HTTPS flow setup.	The value is an integer ranging from 1 to 3600, in seconds.
redirect-packet blocking-rate	Specifies the TCP SYN packet processing rate in blocking state.	The value is an integer that ranges from 1 to 10, in packets/second.

Views

HTTPS redirect view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
portal	write

Usage Guidelines

Usage Scenario

To prevent some users from using HTTPS TCP SYN packets with changing destination IP addresses to attack the device so that the HTTPS redirection function is not affected for other users, you need to restrict the rate at which HTTPS redirection packets are sent as a reply to each user. You can run the chasten redirect-packet command to configure the number of seconds during which a device is frozen if the number of HTTPS redirection packets replied by the device to the user within a specified period exceeds the preset threshold. Within this freezing period, the device discards the HTTPS TCP SYN packets sent by the user.

Precautions

In VS mode, this command is supported only by the admin VS.

Example

# Configure the device to process one TCP SYN packet every second in the next 3000 seconds and discard extra packets after the number of HTTPS redirection packets replied by the device to the user reaches 10000 within 3000 seconds.

<HUAWEI> system-view
[~HUAWEI] access https-redirect
[~HUAWEI-access-https-redirect] chasten redirect-packet 10000 3000 3000 1