Configuring UDP Flood Attack Defense

This section describes how to configure global and interface-based UDP flood attack defense.

Prerequisites

The interface-based traffic statistics collection function is enabled.

Procedure

Configure global UDP flood attack defense.
1. In the user view, access the system view.
```
system-view
```
2. Configure global UDP flood attack defense.
```
anti-ddos udp-flood dynamic-fingerprint-learn [ alert-speed alert-speed ]
```
  If the rate of UDP packets reaches alert-speed, the global UDP flood attack defense function is triggered. alert-speed is an integer ranging from 1 to 10240, in Mbit/s. The default value is 50.
  
  The defense threshold can be automatically learned or manually configured. For details about the threshold learning configuration, see Configuring Threshold Learning.
3. Set the dynamic fingerprint learning mode.
```
anti-ddos udp-fingerprint-learn offset offset fingerprint-length fingerprint-length
```
  offset is an integer ranging from 0 to 1500, in bytes. fingerprint-length is an integer ranging from 1 to 8.
  
  By default, only the last eight bytes of a data segment are used for fingerprint learning.
4. Enable the packet length learning function.
```
anti-ddos udp-fingerprint-learn packet-length enable
```
  The packet length learning function is enabled by default.
5. Configure destination IP address-based traffic limiting.
```
bandwidth-limit destination-ip type udp max-speed max-speed
```
  max-speed is an integer ranging from 1 to 2000000, in Mbps.
  
  After this function is configured, the FW collects the statistics on the UDP packets that arrive at each destination IP address. If the number of UDP packets that arrive at a destination IP address exceeds the maximum value, the FW discards excess packets.
6. Configure session-based UDP rate limiting.
```
firewall defend udp-flood base-session max-rate max-rate-number
```
  max-rate-number is an integer ranging from 1 to 65535, in pps.
  
  After this command is executed, the FW collects the statistics on the UDP packets over each session. If the rate of UDP packets over a session exceeds the maximum value, the FW discards excess packets.
Configure interface-based UDP flood attack defense.
1. In the user view, access the system view.
```
system-view
```
2. Access the interface view.
```
interface interface-type interface-number
```
3. Configure interface-based UDP flood attack defense.
```
anti-ddos udp-flood relation-defend source-detect [ alert-speed alert-speed ]
```
  If the rate of UDP packets reaches alert-speed, the interface-based UDP flood attack defense function is triggered. alert-speed is an integer ranging from 1 to 10240, in Mbit/s. The default value is 850.
  
  The attack defense threshold learning applies only to global DDoS attack defense and not to interface-based DDoS attack defense. Therefore, the threshold for interface-based UDP flood attack defense must be configured using the anti-ddos udp-flood relation-defend source-detect command.
Configure global UDP fragment flood attack defense.
1. In the user view, access the system view.
```
system-view
```
2. Configure global UDP fragment flood attack defense.
```
anti-ddos udp-frag-flood dynamic-fingerprint-learn [ alert-speed alert-speed ]
```
  If the rate of UDP fragments reaches alert-speed, the global UDP fragment flood attack defense function is triggered. alert-speed is an integer ranging from 1 to 10240, in Mbit/s. The default value is 50.
  
  The defense threshold can be automatically learned or manually configured. For details about the threshold learning configuration, see Configuring Threshold Learning.
Configure interface-based UDP fragment flood attack defense.
1. In the user view, access the system view.
```
system-view
```
2. Access the interface view.
```
interface interface-type interface-number
```
3. Configure interface-based UDP fragment flood attack defense.
```
anti-ddos udp-frag-flood [ alert-speed alert-speed ]
```
  If the rate of UDP fragment packets reaches alert-speed, the interface-based UDP fragment flood attack defense function is triggered. alert-speed is an integer ranging from 1 to 10240, in Mbit/s. The default value is 200.
  
  The attack defense threshold learning applies only to global DDoS attack defense and not to interface-based DDoS attack defense. Therefore, the threshold for interface-based UDP fragment flood attack defense must be configured manually using the anti-ddos udp-frag-flood command.