Thank you. It makes more sense now.
-----Original Message-----
From: Stephen Gill [mailto:gillsr@yahoo.com]
Sent: Wednesday, April 02, 2003 4:17 PM
To: Wilson, Michael; juniper-nsp@puck.nether.net
Cc: team-cymru@cymru.com
Subject: RE: [j-nsp] How to protect m-series from bad guy
Hi Michael,
The syntax is a logical OR on the bit position in the IP packet.
Checking for the SYN bit will return true if the SYN bit is on no matter
what other bits are set in the packet.
For more details on the firewall filter syntax for tcp-flags I recommend
the following URL:
http://www.juniper.net/techpubs/software/junos/junos56/swconfig56-policy /html/firewall-config14.html
In theory you could change the policy to be:
tcp-flags "syn & ack";
-- steve
-----Original Message-----
From: Wilson, Michael [mailto:mkwilson@uslec.com]
Sent: Wednesday, April 02, 2003 10:01 AM
To: 'Stephen Gill'; 'juniper-nsp@puck.nether.net'
Cc: team-cymru@cymru.com
Subject: RE: [j-nsp] How to protect m-series from bad guy
Hello Stephen-
I was looking at the secure junos-template, and I'm a little confused by
the
tcp-flood-detect filter. It says to apply this outbound to lo0, and
that an
indication of a possible flood attack could be a "high packets-syn to
packets-tcp" ratio. Does this assume that the router is the origin of
the
attack? If the attack is originating from another host and targeting
the
router, wouldn't we need to count the outbound syn-acks from the router?
Or
does the "syn" flag count both syn and syn-ack packets? Good chance I'm
missing something here, but thought I'd ask anyway. Thanks for any
clarifications.
-----Original Message-----
From: Stephen Gill [mailto:gillsr@yahoo.com]
Sent: Friday, March 28, 2003 12:33 PM
To: hhadiwinoto@hotpop.com;
Cc: team-cymru@cymru.com
Subject: RE: [j-nsp] How to protect m-series from bad guy
Hi Hendro,
Here are a few documents for starters.
JUNOS Secure Template
http://www.qorbit.net/documents/junos-template.pdf http://www.qorbit.net/documents/junos-template.htm JUNOS Secure BGP Template
http://www.qorbit.net/documents/junos-bgp-template.pdf http://www.qorbit.net/documents/junos-bgp-template.htm JUNOS Secure BGP Application Note
http://www.qorbit.net/documents/junos-bgp-appnote.pdf http://www.qorbit.net/documents/junos-bgp-appnote.htm JUNOS Loose ISP Prefix Filter Template
http://www.qorbit.net/documents/junos-isp-prefix-filter-loose.pdf http://www.qorbit.net/documents/junos-isp-prefix-filter-loose.htm JUNOS Strict ISP Prefix Filter Template
http://www.qorbit.net/documents/junos-isp-prefix-filter-strict.pdf http://www.qorbit.net/documents/junos-isp-prefix-filter-strict.htm Some sample JUNOS configurations for remotely triggered blackhole
filtering can also be found here:
http://www.cymru.com/BGP/bogon-rs.html http://www.secsup.org/CustomerBlackHole/ Comments and / or suggestions are always appreciated.
Cheers,
Steve, for Team Cymru
http://www.cymru.com/About/teamcymru.html -- steve
gillsr@yahoo.com
-----Original Message-----
From: juniper-nsp-bounces@puck.nether.net
[mailto:juniper-nsp-bounces@puck.nether.net] On Behalf Of
hhadiwinoto@hotpop.com
Sent: Friday, March 28, 2003 11:12 AM
To: juniper-nsp@puck.nether.net
Subject: [j-nsp] How to protect m-series from bad guy
Hi,
In order to hardern my M-series, I would like to ask you how to
configure
M-series to detect anti-dos, tcp-flood, land-attack, or other security
threats.
I have downloaded some security white papers from juniper web site, but
would like to know other resources besides the juniper web site.
Any help would be appreciated. Thanks.
Regards
Hendro
--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/juniper-nsp