網(wǎng)絡(luò)基礎(chǔ)設(shè)施安全-路由系統(tǒng)-資料下載頁
2024-10-04 19:48本頁面
【正文】 ) interface serial 0 Router(configif) ip accessgroup 47 out Router(configif) ip accessgroup 103 in 路由系統(tǒng)安全 使用路由器防止拒絕服務(wù)的攻擊 防止 DOS 攻擊 ? no ip directedbroadcast ? 入流量過濾、出流量過濾 ? CAR(mitted access rate) 限制某種類型包的發(fā)送速率 interface serial 0 ratelimit output accessgroup 105 1540000 512022 786000 conformaction transmit exceedaction drop accesslist 105 permit icmp any any echoreply 過濾出入的包 進入過濾： interface Serial 0 ip address ip accessgroup 11 in accesslist 11 deny accesslist 11 deny accesslist 11 deny accesslist 11 deny your internal work accesslist 11 permit any 離開過濾： interface Ether 0 ip address ip accessgroup 12 in accesslist 12 permit your internal work ip verify unicast reversepath 外部網(wǎng)絡(luò) s0 eth0 內(nèi)部網(wǎng)絡(luò) TCP 攔截 限制 SYN 攻擊 inter 客戶機請求被攔截和驗證 與客戶機建立連接 有效連接被交換，數(shù)據(jù)被傳遞 ip tcp intercept list 100 ip tcp intercept connectiontimeout 60 ip tcp intercept watchtimeout 10 ip tcp intercept oneminute low 1500 ip tcp intercept oneminute high 6000 accesslist 100 permit tcp any TCP 攔截 限制 SYN 攻擊 TCPClientTCPCollapsarSYNSEQ = 100ACK = 0SYN/ACKSEQ = 1000ACK = 101ACKSEQ = 101ACK = 1001TCPSYNSEQ = 80000ACK = 0SYN/ACKSEQ = 200ACK = 80001ACKSEQ = 80001ACK = 201ServerPSHSEQ = 101ACK = 1001PSHSEQ = 80001ACK = 201ACKSEQ = 201ACK = 8010ACKSEQ = 1001ACK = 110Hash( src ip/port , dst ip/port )存入內(nèi)存中的H a s h 表Hash( src ip/port , dst ip/port )查內(nèi)存中的H a s h 表9 byte9 byteTCP 攔截 限制 SYN 攻擊 – Can do as much good as bad – If enabled : process switching and not “full” CEF anymore – The “destination” host must send a RST (no silent drops) or you’ll DoS yourself – Same is true if you use “blackholed” routes (route to Null0) ip tcp intercept list 100 ip tcp intercept connectiontimeout 60 ip tcp intercept watchtimeout 10 ip tcp intercept oneminute low 1500 ip tcp intercept oneminute high 6000 accesslist 100 permit tcp any
范文總結(jié)相關(guān)推薦
鄂ICP備17016276號-1