Allied Telesis management software layer 2+ fast ethernet switches manual SET DOS Pingofdeath

AT-S62 Command Line User’s Guide

SET DOS PINGOFDEATH

Syntax

set dos pingofdeath port=port state=enabledisable [mirrorport=port]

Parameters
port	Specifies the switch ports on which to enable or
	disable the Ping of Death defense. You can specify
	more than one port at a time.
state	Specifies the state of the IP Option defense. The
	options are:
	enable	Activates the defense.
	disable	Deactivates the defense. This is the default.
mirrorport	Specifies a port where invalid traffic is copied. You can
	specify only one port.

Description

This command activates and deactivates the Ping of Death DoS defense.

In this DoS, an attacker sends an oversized, fragmented Ping packet to the victim, which, if lacking a policy for handling oversized packets, may freeze.

To defend against this form of attack, a switch port searches for the last fragment of a fragmented Ping request and examines its offset to determine if the packet size is greater than 63,488 bits. If it is, the fragment is forwarded to the switch’s CPU for final packet size determination. If the switch determines that the packet is oversized, the following occurs:

❑The switch sends a trap to the management workstations.

❑The switch port discards the fragment and, for a one minute period, discards all ingress Ping packets on the port.

371