close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

show security screen ids-option

date_range 19-Nov-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
show security screen ids-option
screen-name
logical-system
root-logical-system
tenant

Description

Display the configuration information about the specified security screen. You can configure a ids-option to enable screen protection on the SRX Series Firewalls.

Options

screen-name—Name of the screen.
logical-system—Name of the logical system.
root-logical-system—Displays root logical system as default.
tenant—Name of the tenant system.

Required Privilege Level

view

Output Fields

Table 1 lists the output fields for the show security screen ids-option command. Output fields are listed in the approximate order in which they appear.

Table 1: show security screen ids-option Output Fields
Field Name	Field Description
`TCP address sweep threshold`	Number of microseconds for which the device accepts 10 TCP packets from the same remote source to different destination addresses.
`TCP port scan threshold`	Number of microseconds during which the device accepts packets from the same remote source with up to 10 different port numbers.
`ICMP address sweep threshold`	Number of microseconds during which up to 10 ICMP echo requests from the same host are allowed into the device.
`UDP flood threshold`	Number of UDP packets per second allowed to ping the same destination address before the device rejects further UDP packets.
`UDP port scan threshold`	Number of microseconds during which the device accepts packets from the same remote source IP with up to 10 different destination port numbers.
`TCP winnuke`	Enable or disable the detection of TCP WinNuke attacks.
`TCP SYN flood attack threshold`	Number of SYN packets per second required to trigger the SYN proxy response.
`TCP SYN flood alarm threshold`	Number of half-complete proxy connections per second at which the device makes entries in the event alarm log.
`TCP SYN flood source threshold`	Number of SYN segments to be received per second before the device begins dropping connection requests.
`TCP SYN flood destination threshold`	Number of SYN segments received per second before the device begins dropping connection requests.
`TCP SYN flood timeout`	Maximum length of time before a half-completed connection is dropped from the queue.
`TCP SYN flood queue size`	Number of proxy connection requests that can be held in the proxy connection queue before the device begins rejecting new connection requests.
`ICMP large packet`	Enable or disable the detection of any ICMP frame with an IP length greater than 1024 bytes.
`UDP address sweep threshold`	Number of microseconds for which the device accepts 10 UDP packets from the same remote source to different destination addresses.
`IPv6 extension routing`	Enable or disable the IPv6 extension routing screen option.
`IPv6 extension shim6`	Enable or disable the IPv6 extension shim6 screen option.
`IPv6 extension fragment/IP block fragment`	Enable or disable the IPv6 extension fragment screen option.
`IPv6 extension AH`	Enable or disable the IPv6 extension Authentication Header Protocol screen option.
`IPv6 extension ESP`	Enable or disable the IPv6 extension Encapsulating Security Payload screen option.
`IPv6 extension mobility`	Enable or disable the IPv6 extension mobility screen option.
`IPv6 extension HIP`	Enable or disable the IPv6 extension Host Identify Protocol screen option.
`IPv6 extension no next`	Enable or disable the IPv6 extension no-next screen option.
`IPv6 extension user-defined`	Enable or disable the IPv6 extension user-defined screen option.
`IPv6 extension HbyH jumbo`	Enable or disable the IPv6 extension HbyH jumbo screen option.
`IPv6 extension HbyH RPL`	Enable or disable the IPv6 extension HbyH RPL screen option.
`IPv6 extension HbyH router alert`	Enable or disable the IPv6 extension HbyH router screen option.
`IPv6 extension HbyH quick start`	Enable or disable the IPv6 extension HbyH quick-start screen option.
`IPv6 extension HbyH CALIPSO`	Enable or disable the IPv6 extension HbyH Common Architecture Label IPv6 Security Screen option.
`IPv6 extension HbyH SMF DPD`	Enable or disable the IPv6 extension HbyH Simplified Multicast Forwarding IPv6 Duplicate Packet Detection screen option.
`IPv6 extension HbyH user-defined`	Enable or disable the IPv6 extension HbyH user-defined screen option.
`IPv6 extension Dst tunnel encap limit`	Enable or disable the IPv6 extension distributed (network) storage tunnel encapsulation limit screen option.
`IPv6 extension Dst home address`	Enable or disable the IPv6 extension DST home address screen option.
`IPv6 extension Dst ILNP nonce`	Enable or disable the IPv6 extension DST Identifier-Locator Network Protocol nonce screen option.
`IPv6 extension Dst line-id`	Enable or disable the IPv6 extension DST line-ID screen option.
`IPv6 extension Dst user-defined`	Enable or disable the IPv6 extension DST user-defined screen option.
`IPv6 extension header limit`	Threshold for the number of IPv6 extension headers that can pass through the screen.
`IPv6 malformed header`	Enable or disable the IPv6 malformed header screen option.
`ICMPv6 malformed header`	Enable or disable the ICMPv6 malformed packet screen option.
`UDP flood white-list`	Allowlist of IP addresses to bypass UDP flood detection.
`IP block fragment white-list`	Allowlist of IP addresses to bypass IP block fragmentation check.
`Session source limit threshold`	Limit the number of concurrent sessions the device can initiate from a single source IP address or the number of sessions it can direct to a single destination IP address.
`Logical system/Tenant`	Name of the logical system or tenant system.

Sample Output

show security screen ids-option jscreen

content_copy zoom_out_map
user@host> show security screen ids-option jscreen 
Screen object status:
Name                                         Value
  TCP port scan threshold                    5000
  UDP port scan threshold                    10000
  ICMP address sweep threshold               5000

Sample Output

show security screen ids-option jscreen (IPv6)

content_copy zoom_out_map
user@host> show security screen ids-option jscreen

Screen object status:

   Name                                        Value
  ICMP ping of death                         enabled
  ……

  IPv6 extension routing                     enabled    
  IPv6 extension shim6                       enabled    
  IPv6 extension fragment                    enabled    
  IPv6 extension AH                          enabled    
  IPv6 extension ESP                         enabled    
  IPv6 extension mobility                    enabled    
  IPv6 extension HIP                         enabled    
  IPv6 extension no next                     enabled    
  IPv6 extension user-defined                enabled    
  IPv6 extension HbyH jumbo                  enabled    
  IPv6 extension HbyH RPL                    enabled    
  IPv6 extension HbyH router alert           enabled    
  IPv6 extension HbyH quick start            enabled    
  IPv6 extension HbyH CALIPSO                enabled    
  IPv6 extension HbyH SMF DPD                enabled    
  IPv6 extension HbyH user-defined           enabled    
  IPv6 extension Dst tunnel encap limit      enabled    
  IPv6 extension Dst home address            enabled    
  IPv6 extension Dst ILNP nonce              enabled    
  IPv6 extension Dst line-id                 enabled    
  IPv6 extension Dst user-defined            enabled    
  IPv6 extension header limit                20     
  IPv6 Malformed header                      enabled    
  ICMPv6 malformed packet                    enabled    

Sample Output

show security screen ids-option jscreen1 node all
show security screen ids-option jscreen tenant TN1
show security screen ids-option jscreen tenant all
show security screen ids-option jscreen (IP block fragment screen)

show security screen ids-option jscreen1 node all

content_copy zoom_out_map
user@host> show security screen ids-option jscreen1 node all           
node0:
--------------------------------------------------------------------------
Screen object status:
Name                                         Value
  UDP flood threshold                        1000       
  TCP winnuke                                enabled    
  TCP SYN flood attack threshold             200        
  TCP SYN flood alarm threshold              512        
  TCP SYN flood source threshold             4000       
  TCP SYN flood destination threshold        4000       
  TCP SYN flood timeout                      20         
  TCP SYN flood queue size                   1024       
  ICMP large packet                          enabled    
node1:
--------------------------------------------------------------------------
Screen object status:
Name                                         Value
  UDP flood threshold                        1000       
  TCP winnuke                                enabled    
  TCP SYN flood attack threshold             200        
  TCP SYN flood alarm threshold              512        
  TCP SYN flood source threshold             4000       
  TCP SYN flood destination threshold        4000       
  TCP SYN flood timeout                      20         
  TCP SYN flood queue size                   1024       
  ICMP large packet                          enabled 

show security screen ids-option jscreen tenant TN1

content_copy zoom_out_map
user@host> show security screen ids-option jscreen tenant TN1

Screen object status:

Name                                       value      
UDP flood threshold                        1000       
UDP flood white-list                       a1         
UDP flood white-list                       a2         

show security screen ids-option jscreen tenant all

content_copy zoom_out_map
user@host> show security screen ids-option jscreen tenant all

Logical system: root-logical-system
Screen object status:

Name                                       value      
UDP flood threshold                        1          
UDP flood white-list                       a1         
UDP flood white-list                       a2         
IP block fragment                          enabled    
Session source limit threshold             5          

Tenant: TN1
Screen object status:

Name                                       value      
UDP flood threshold                        1000       
UDP flood white-list                       a1         
UDP flood white-list                       a2

show security screen ids-option jscreen (IP block fragment screen)

content_copy zoom_out_map
user@host> show security screen ids-option jscreen

Screen object status:

Name                                       value      
IP block fragment                          enabled      
IP block fragment white-list               a1         
IP block fragment white-list               a2         

Release Information

Command introduced in Junos OS Release 8.5. Support for UDP port scan added in Junos OS Release 12.1X47-D10.

Support for node option added in Junos OS Release 9.0.

Support for IPv6 extension header screens added in Junos OS Release 12.1X46-D10.

The tenant option is introduced in Junos OS Release 18.3R1.

The IP block fragment allowlist option added in Junos OS Release 22.2R1.

arrow_backward PREVIOUS show security resource-manager summary

NEXT arrow_forward show security screen statistics

Junos CLI Reference

ON THIS PAGE

show security screen ids-option

Syntax

Description

Options

Required Privilege Level

Output Fields

Sample Output

show security screen ids-option jscreen

Sample Output

show security screen ids-option jscreen (IPv6)

Sample Output

show security screen ids-option jscreen1 node all

show security screen ids-option jscreen tenant TN1

show security screen ids-option jscreen tenant all

show security screen ids-option jscreen (IP block fragment screen)

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

show security screen ids-option

Syntax

Description

Options

Required Privilege Level

Output Fields

Sample Output

show security screen ids-option jscreen

Sample Output

show security screen ids-option jscreen (IPv6)

Sample Output

show security screen ids-option jscreen1 node all

show security screen ids-option jscreen tenant TN1

show security screen ids-option jscreen tenant all

show security screen ids-option jscreen (IP block fragment screen)

Release Information

Related Documentation

Stay in touch