|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: SYN floods continueg
On Wed, 11 Sep 1996, Bruce Robertson wrote: ==>It seems to me that you want something more like this, which is what ==>we have in place: ==> ==> acc 102 deny ip 198.138.103.0 0.0.0.255 any ==> ... ==> acc 102 permit any any ==> ==>It seems to work for us. Please let me know if I'm missing something here! This works for stopping the spoofing of your own internal hosts from getting packets into your network. To stop the problem that's presented here (of packets flowing out of your network with random IP addresses (as one can do on a Linux-box dial-up)), you need an outbound filter based on source-address, like the following: access-list 102 permit ip 205.166.195.0 0.0.0.255 any access-list 102 permit ip 205.166.254.0 0.0.0.255 any interface Serial0 ip access-group 102 out This will allow packets sourced from hosts in the 205.166.195.0-205.166.195.255 and 205.166.254.0-205.166.254.255 range out, but other packets will be stopped at that router, including those SYN floods with random source IP's. Depending upon your network architecture, the optimal placement of these lines varies. /cah ---- Craig A. Huegen CCIE #2100 || || Network Analyst, IS-Network/Telecom || || cisco Systems, Inc., 250 West Tasman Drive |||| |||| San Jose, CA 95134, (408) 526-8104 ..:||||||:..:||||||:.. email: [email protected] c i s c o S y s t e m s - - - - - - - - - - - - - - - - -
|