Configuring a scanning attack defense policy

Scanning attack detection inspects the incoming packet rate of connections to the device. If a source initiates connections at a rate equal to or exceeding the pre-defined threshold, the device can take the following actions:

• Output logs.

• Drop subsequent packets from the IP address of the attacker.

• Add the attacker's IP address to the IP blacklist.

1. Enter system view.

   system-view

2. Enter attack defense policy view.

   attack-defense policy policy-name

3. Configure scanning attack detection.

   scan detect level { high | low | medium } action { { block-source [ timeout minutes ] | drop } | logging } *

   By default, scanning attack detection is not configured.