ProCurve 6200yl User's Guide download pdf (Page 66)

100

101

3-6

Virus Throttling

Overview of Connection-Rate Filtering

Application Options

For the most part, normal network traffic is distinct from the traffic exhibited

by malicious agents. However, when a legitimate network host generates

multiple connections in a short period of time, connection-rate filtering may

generate a “false positive” and treat the host as an infected client. Lowering

the sensitivity or changing the filter mode may reduce the number of false

positives. Conversely, relaxing filtering and sensitivity provisions lowers the

switch’s ability to detect worm-generated traffic in the early stages of an

attack, and should be carefully investigated and planned to ensure that a risky

vulnerability is not created. As an alternative, you can use connection-rate

ACLs (access control lists) or selective enabling to allow legitimate traffic.

Selective Enable. This option involves applying connection-rate filtering

only to ports posing a significant risk of attack. For ports that are reasonably

secure from attack, then there may be little benefit in configuring them with

connection-rate filtering.

Connection-Rate ACLs. The basic connection-rate filtering policy is con-

figured per-port as notify-only, throttle, and block. A connection-rate ACL cre-

ates exceptions to these per-port policies by creating special rules for

individual hosts, groups of hosts, or entire subnets. Thus, you can adjust a

connection-rate filtering policy to create and apply an exception to configured

filters on the ports in a VLAN. Note that connection-rate ACLs are useful only

if you need to exclude inbound traffic from your connection-rate filtering

policy. For example, a server responding to network demand may send a

relatively high number of legitimate connection requests. This can generate a

false positive by exhibiting the same elevated connection-rate behavior as a

worm. Using a connection-rate ACL to apply an exception for this server

allows you to exclude the trusted server from connection-rate filtering and

thereby keep the server running without interruption.

Note Use connection-rate ACLs only when you need to exclude an IP traffic source

(including traffic with specific UDP or TCP criteria) from a connection-rate

filtering policy. Otherwise, the ACL is not necessary.

1 2 ... 61 62 63 64 65 66 67 68 69 70 71 ... 595 596

Comments to this Manuals

No comments

ProCurve 6200yl User's Guide Page 66

Comments to this Manuals

Related products and manuals for Network switches ProCurve 6200yl