02.10.2013 Views

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

To enable a Trace list, use <strong>the</strong> following command in <strong>the</strong> CONFIGURATION mode:<br />

Command Syntax Command Mode Purpose<br />

ip trace-group trace-list-name CONFIGURATION Enable a configured Trace list to filter traffic.<br />

To remove a Trace list, use <strong>the</strong> no ip trace-group trace-list-name command syntax.<br />

Once <strong>the</strong> Trace list is enabled, you can view its log with <strong>the</strong> show ip accounting trace-list trace-list-name<br />

[linecard number] command.<br />

<strong>Force10</strong>#show ip accounting trace-list dilling<br />

Trace List dilling on linecard 0<br />

seq 2 permit ip host 10.1.0.0 any count (0 packets)<br />

seq 5 deny ip any any<br />

<strong>Force10</strong>#<br />

Figure 85 show ip accounting trace-list Command Example<br />

Protecting Against TCP Tiny and Overlapping Fragment<br />

Attack<br />

Tiny and overlapping fragment attack is a class of attack where configured ACL entries—denying TCP<br />

port-specific traffic—can be bypassed, and traffic can be sent to its destination although denied by <strong>the</strong><br />

ACL. RFC 1858 and 3128 proposes a countermeasure to <strong>the</strong> problem. This countermeasure is configured<br />

into <strong>the</strong> line cards and enabled by default.<br />

<strong>FTOS</strong> <strong>Configuration</strong> <strong>Guide</strong>, version 7.7.1.0 173

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!