ipv4 (Security IDP Signature Attack)
Syntax
ipv4 {
checksum-validate {
match (equal | greater-than | less-than | not-equal | validate);
value value;
}
destination (Security IP Headers Attack) {
match (equal | greater-than | less-than | not-equal);
value value;
}
identification (Security ICMP Headers) {
match (equal | greater-than | less-than | not-equal);
value value;
}
ihl {
match (equal | greater-than | less-than | not-equal);
value value;
}
ip-flags <(df | no-df)> <(mf | no-mf)> <(rb | no-rb)>;
protocol {
match (equal | greater-than | less-than | not-equal);
value value;
}
source {
match (equal | greater-than | less-than | not-equal);
value value;
}
tos {
match (equal | greater-than | less-than | not-equal);
value value;
}
total-length {
match (equal | greater-than | less-than | not-equal);
value value;
}
ttl {
match (equal | greater-than | less-than | not-equal);
value value;
}
}
Hierarchy Level
[edit security idp custom-attack attack-name attack-type signature protocol]
Description
An IP header is header information at the beginning of an IP packet which contains information about IP version, source IP address, destination IP address, time-to-live, etc. Allow IDP to match the IP header information for the signature attack.
Options
The remaining statements are explained separately. See CLI Explorer.
| identification | Specify a unique value used by the destination system to reassemble a fragmented packet.
|
| ihl | Specify the IPv4 header length in words.
|
| ip-flags | Specify that IDP looks for a pattern match whether or not the IP flag is set.
|
| protocol | Specify the Transport Layer protocol number.
|
| source | Specify the IP address or hostname of the attacking device.
|
| tos | Specify the type of service.
|
| total-length | Specify the number of bytes in the packet, including all header fields and the data payload.
|
| ttl | Specify the time-to-live (TTL) value of the packet. This value represents the number of routers the packet can pass through. Each router that processes the packet decrements the TTL by 1; when the TTL reaches 0, the packet is discarded.
|
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 9.3.