topic RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model in ExtremeSwitching (EOS)

HostDos no functioning as expected on Enterasys/Extreme S6 Model

Sarafa_Ibrahim — Thu, 29 Jun 2017 19:58:00 GMT

I enabled HostDos on the S6 chassis switch to drop SYN FLOOD packets over 1000pps threshold, but these packets still bypass the switch as they hit the firewall LAN interface - I am running the SYN Flood test locally. I checked the logs and there were no hits on the HostDos stats menu for SynFlood. Please I need insights into this. What could be wrong? I set the threshold on the firewall to 1200pps and I confirmed the S6 was blacklisted as SYN packets received were over 1200pps - which tells me the S6 did not drop those packets when it got hit by them.

Thank you for your time.

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Daniel_Coughlin — Thu, 29 Jun 2017 20:35:00 GMT

Hostdos only protects the host complex of the S-series. The packets are still allowed to transit on the vlans they exist on.

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Sarafa_Ibrahim — Thu, 29 Jun 2017 20:35:00 GMT

Thank you for your response. I did not quite follow what you mean by "host complex". Could you elaborate on that? thanks

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Erik_Auerswald — Thu, 29 Jun 2017 20:35:00 GMT

Hi,

the HostDoS feature protects against attacks target at the switch itself only, not against attacks passing through the switch towards another target.

Thanks,
Erik

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Sarafa_Ibrahim — Thu, 29 Jun 2017 20:35:00 GMT

Okay. Thank you for clarifying that. Is there any way to get around this though?

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Erik_Auerswald — Thu, 29 Jun 2017 20:35:00 GMT

You would need to classify the traffic on TCP flags and then apply a rate limiter. I do not think this is supported on the S-Series.

Another problem is that above classification matches any TCP SYN packet and does not separate by source IP. That would limit the number of connections per second to the server, not just SYN floods.

Routers, firewalls or other security appliances implementing SYN flood protection in software are a better solution than using a switch. The switch is supposed to deliver all the traffic at line rate...

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Sarafa_Ibrahim — Thu, 29 Jun 2017 20:35:00 GMT

Thanks Erik!

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Daniel_Coughlin — Thu, 29 Jun 2017 20:35:00 GMT

Sarafa, If you need more help the GTAC is always an option.

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Sarafa_Ibrahim — Thu, 29 Jun 2017 20:35:00 GMT

Thanks, Daniel! I'd keep that in mind.

RE: HostDos no functioning as expected on Enterasys/Extreme S6 Model

Drew_C — Fri, 30 Jun 2017 21:16:00 GMT

Welcome to The Hub, Sarafa!