Viewing a DoS profile

The show dospreventionprofile command, when executed, displays the specified DoS prevention profile information for the Sensor that is defined in two arguments: a DoS measure name and a traffic direction.

Syntax:

show dospreventionprofile <dos-measure-name> <inbound | outbound>

Example - Command execution:

show dospreventionprofile udp inbound

Information displayed by the show dospreventionprofile command includes the Sensor's DoS profile and the traffic direction protected by the profile.

Example - Result:

 show dospreventionprofile udp inbound 

packet type: UDP IN (12), profile stage: normal operation (65) 

long-term average rate=0.000(pkts/s), last_rate=0.000(pkts/s) 

no attack in progress 

each line: bin_index, IP_prefix/prefix_len, AS, LT, ST, ltR(ate), stR(ate) 

AS(%) -- percentage of the IP address space this bin occupies 

LT(%) -- percentage of long-term traffic that falls into this bin 

ST(%) -- percentage of short-term traffic that falls into this bin 

ltRate -- long-term average traffic rate (in pkts/s) for this bin 

stRate -- short-term traffic rate (in pkts/s) for this bin 

0: 0.0.0.0/2 AS=25.000% LT=25.000% ST=25.00% ltR=0.000 stR=0.000 

1: 128.0.0.0/2 AS=25.000% LT=25.000% ST=25.00% ltR=0.000 stR=0.000 

2: 64.0.0.0/2 AS=25.000% LT=25.000% ST=25.00% ltR=0.000 stR=0.000 

3: 192.0.0.0/2 AS=25.000% LT=25.000% ST=25.00% ltR=0.000 stR=0.000

The following is an example of a "bad" bin marked with a "*". The Sensor blocks packets with source IPs in the particular bin.

0: 0.0.0.0/6 AS=1.563% LT=49.969% ST=100.00% stR=1.000

1: 128.0.0.0/2 AS=25.000% LT=0.021% ST=0.00% stR=0.000

*2: 64.0.0.0/2 AS=25.000% LT=1.615% ST=100.00% ltR=2357.098 stR=148966.400

3: 192.0.0.0/2 AS=25.000% LT=0.021% ST=0.00% stR=0.000

4: 32.0.0.0/3 AS=12.500% LT=0.000% ST=0.00% stR=0.000

5: 16.0.0.0/4 AS=6.250% LT=0.000% ST=0.00% stR=0.000

6: 8.0.0.0/5 AS=3.125% LT=0.000% ST=0.00% stR=0.000

7: 4.0.0.0/6 AS=0.000% LT=11.752% ST=0.00% ltR=16885.654 stR=0.000