SPRUIE9D May 2017 – May 2024 DRA74P , DRA75P , DRA76P , DRA77P
Here is an example of how the rule engine can be programmed to detect packets that resemble Denial of Service traffic. The pseudo code is shown below.
IDLE:
jump to ICMP if start_of_packet
ICMP:
if (protocol==ICMP)
limit_ICMP
if (fragmented packet)
drop and jump to IDLE
accept and jump to IDLE
else
jump to IP
IP:
if (source_ip==dest_ip)
drop and jump to IDLE
if (fragmented and (fragment_offset+ip_size)>2^16)
drop and jump to IDLE
accept the packet and jump to IDLE