User Manual

Insight Managed 8-Port Gigabit (Hi-Power) PoE+ Smart Cloud Switch with NETGEAR FlexPoE Power
Configure System Information User Manual70
For more information about the local device password and the Insight network password,
see
Credentials for the local browser UI on page 28.
5. Click the Login button.
The System Information page displays.
6. Select System > Management > Denial of Service > Denial of Service Configuration.
The Denial of Service Configuration page displays.
7. Select the types of DoS attacks for the switch to monitor and block and configure any
associated values:
• Denial of Service Min TCP Header Size. Specify the minimum TCP header size
allowed. If you select the Denial of Service TCP Fragment radio button, the switch
drops the first TCP fragment with a TCP payload packet for which the minimum TCP
header size is larger than the IP payload length minus the IP header size. The range
for the minimum TCP header size is from 0 to 31. The default value is 20.
• Denial of Service Max ICMP Packet Size. Specify the maximum ICMPv4 packet
size allowed. If ICMPv4 DoS prevention or ICMPv6 DoS prevention is enabled, the
switch drops ICMPv4 or ICMPv6 ping packets with a size greater than the configured
value. The range is from 0 to 16376. The default value is 512.
• Denial of Service ICMPv4. Enabling ICMPv4 DoS prevention causes the switch to
drop ICMPv4 packets with a type set to ECHO_REQ (ping) and a size greater than
the configured ICMPv4 packet size.
• Denial of Service ICMPv6. Enabling ICMPv6 DoS prevention causes the switch to
drop ICMPv6 packets with a type set to ECHO_REQ (ping) and a size greater than
the configured ICMPv6 packet size.
• Denial of Service Ping of Death. Enabling Ping of Death DoS prevention causes the
switch to drop ICMP ping packets that are larger than 65535 bytes.
• Denial of Service IPv6 Fragment. Enabling IPv6 Fragment DoS prevention causes
the switch to drop IPv6 packets that contain a fragment header with the more flag set
to 1 and for which the payload length less than 1240.
• Denial of Service ICMP Fragment. Enabling ICMP Fragment DoS prevention
causes the switch to drop ICMP fragmented packets.
• Denial of Service Smurf. Enabling Smurf DoS prevention causes the switch to drop
broadcast ICMP echo request packet.
• Denial of Service SIP=DIP. Enabling SIP=DIP DoS prevention causes the switch to
drop packets with a source IP address equal to the destination IP address.
• Denial of Service SMAC=DMAC. Enabling SMAC=DMAC DoS prevention causes
the switch to drop packets with a source MAC address equal to the destination MAC
address.
• Denial of Service TCP FIN&URG&PSH. Enabling TCP FIN & URG & PSH DoS
prevention causes the switch to drop packets with TCP flags FIN, URG, and PSH set
and the TCP sequence number equal to 0.