View statistics on the packets sent to the CPU. If a large number of packets of a certain type are sent to the CPU or discarded by the CPU within a period of time, there is a possibility that an attack has been initiated by using this type of packet.
<HUAWEI> reset cpu-defend statistics //Delete statistics about packets sent to the CPU and wait for a moment.
<HUAWEI> display cpu-defend statistics all //View statistics about packets sent to the CPU.
For example, when an attacker uses a host on a network to send a large number of ping (ICMP) packets to a network device, the network device consumes many resources to process these packets, causing high CPU usage and user service interruption.
Use the attack source tracing function to quickly locate the attack source
Attack source tracing samples packets sent to the CPU. If the packet rate exceeds the specified threshold, the packets are considered attack packets.
By analyzing the attack packets, you can find out the IP address, MAC address, interface, and VLAN of the attack source.
Attack Source Tracing:
Configuration Roadmap
1. Create an attack defense policy.
2. Configure attack source tracing.
(sampling ratio, threshold, attack source tracing mode, attack packet type,
whitelist, alarm, punishment action)
3. Apply the attack defense policy
Script:
<HUAWEI> system-view //Enter the system view.
[HUAWEI] cpu-defend policy test //Create an attack defense policy test.
[HUAWEI-cpu-defend-policy-test] auto-defend enable //Enable attack source tracing.
[HUAWEI-cpu-defend-policy-test] auto-defend threshold 64 //Set the threshold.
[HUAWEI-cpu-defend-policy-test] auto-defend attack-packet sample 10 //Set the packet sampling ratio.
[HUAWEI-cpu-defend-policy-test] auto-defend alarm enable //Enable attack source tracing alarm.
[HUAWEI-cpu-defend-policy-test] auto-defend alarm threshold 64 //Set the alarm threshold.
[HUAWEI-cpu-defend-policy-test] auto-defend action deny //Configure the punishment action.
[HUAWEI-cpu-defend-policy-test] quit //Return to the system view.
[HUAWEI] cpu-defend-policy test global //Apply the attack defense policy.
References: Huawei guides
