ip-sweep
Syntax
ip-sweep {
threshold number;
}
Hierarchy Level
[edit security screen ids-option screen-name icmp]
Description
Configure the device to detect and prevent an IP Sweep attack. An IP Sweep attack occurs when an attacker sends ICMP echo requests (pings) to multiple destination addresses. If a target host replies, the reply reveals the target’s IP address to the attacker. If the device receives 10 ICMP echo requests within the number of microseconds specified in this statement, it flags this as an IP Sweep attack, and rejects the 11th and all further ICMP packets from that host for the remainder of the second.
Options
threshold number—Maximum number of microseconds during which up to 10
ICMP echo requests from the same host are allowed into the device.
More than 10 requests from a host during this period triggers an IP
Sweep attack response on the device during the remainder of the second.
Range: 1000 through 1,000,000 microseconds
Default: 5000 microseconds
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 8.5.