ProCurve 6200yl User's Guide download pdf (Page 65)

100

101

3-5

Virus Throttling

Overview of Connection-Rate Filtering

General Operation

Connection-rate filtering enables notification of worm-like behavior detected

in inbound IP traffic and, depending on how you configure the feature, also

throttles or blocks such traffic. This feature also provides a method for

allowing legitimate, high connection-rate traffic from a given host while still

protecting your network from possibly malicious traffic from other hosts.

Filtering Options

In the default configuration, connection-rate filtering is disabled. When

enabled on a port, connection-rate filtering monitors inbound IP traffic for a

high rate of connection requests from any given host on the port. If a host

appears to exhibit the worm-like behavior of attempting to establish a large

number of outbound IP connections in a short period of time, the switch

responds in one of the following ways, depending on how connection-rate

filtering is configured:

■ Notify only (of potential attack): While the apparent attack

continues, the switch generates an Event Log notice identifying the

offending host’s source IP address and (if a trap receiver is configured

on the switch) a similar SNMP trap notice).

■ Throttle: In this case, the switch temporarily blocks inbound IP

traffic from the offending host source IP address for a “penalty”

period and generates an Event Log notice of this action and (if a trap

receiver is configured on the switch) a similar SNMP trap notice.

When the “penalty” period expires the switch re-evaluates the traffic

from the host and continues to block this traffic if the apparent attack

continues. (During the re-evaluation period, IP traffic from the host

is allowed.)

■ Block: This option blocks all IP traffic from the host. When a block

occurs, the switch generates an Event Log notice and (if a trap

receiver is configured on the switch) a similar SNMP trap notice. Note

that a network administrator must explicitly re-enable a host that has

been previously blocked.

Sensitivity to Connection Rate Detection

The switch includes a global sensitivity setting that enables adjusting the

ability of connection-rate filtering to detect relatively high instances of con-

nection-rate attempts from a given source.

1 2 ... 60 61 62 63 64 65 66 67 68 69 70 ... 595 596

Comments to this Manuals

No comments

ProCurve 6200yl User's Guide Page 65

Comments to this Manuals

Related products and manuals for Network switches ProCurve 6200yl