< Home

Configuring Ping of Death Attack Defense

Ping of Death is to attack the target system by using large ICMP packets. After receiving such packets, certain systems may crash, stop responding, or restart due to the improper processing of the packets.

Context

Network devices limit the sizes of packets. The length field of IP packets occupies 16 bits. That is, the maximum length of an IP packet is 65535 bytes. Packets larger than 65535 bytes may cause incorrect memory allocation and thus make the target computers stop responding. The attacker can make the TCP/IP stack on the target computers and thus the target computers crash only by running the ping command to continuously send packets that are larger than 65535 bytes.

In defense against Ping of Death attacks, the FW checks whether the sizes of packets are larger than 65535 bytes. If yes, the packets are discarded.

Procedure

  1. In the user view, access the system view.

    system-view

  2. Enable Ping of Death attack defense.

    firewall defend ping-of-death enable

Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >