SPRUI30H November 2015 – May 2024 DRA745 , DRA746 , DRA750 , DRA756
Here is an example of how the rule engine can be programmed to detect packets that resemble Denial of Service traffic. The pseudo code is shown below.
IDLE:
jump to ICMP if start_of_packet
ICMP:
if (protocol==ICMP)
limit_ICMP
if (fragmented packet)
drop and jump to IDLE
accept and jump to IDLE
else
jump to IP
IP:
if (source_ip==dest_ip)
drop and jump to IDLE
if (fragmented and (fragment_offset+ip_size)>2^16)
drop and jump to IDLE
accept the packet and jump to IDLE