security dos udp-portlist
security dos udp-portlist(1) BIG-IP TMSH Manual security dos udp-portlist(1)
NAME
udp-portlist - Configures the DoS udp portlist component within the security dos module using the syntax shown in the
following sections. These DoS udp portlist entries are applied to all udp packets except those going through the management
interface.
MODULE
security dos
SYNTAX
MODIFY
modify udp-portlist dos-udp-portlist
options:
description [string]
list-type [exclude-listed-ports | include-listed-ports]
entries [modify | replace-all-with] {
[entry] {
options:
description [string]
match-direction [both | dst | none | src]
port-number [number]
}
}
DISPLAY
list udp-portlist
DESCRIPTION
You can use the udp-portlist component to configure a DoS UDP portlist of upto eight entries for all UDP traffic except the
management interface. The HSB hardware compares all incoming UDP traffic to the udp-portlist entries. There are 2 types
of behavior, depending upon whether the udp port list is configured as a white list or as a black list. White list and
black list are mutually exclusive properties of a UDP port list.
If the udp port list is configured as a list-type of exclude-listed-ports, and if a match is found on an incoming packet,
then we do not increment the UDP Flood DoS vector. If a match is not found, then the UDP Flood DoS vector checks are done
on those packets.
If the udp port list is configured as a list-type of include-listed-ports, and if a match is found on an incoming packet,
then we increment the UDP Flood DoS vector. If a match is not found, then the UDP Flood DoS vector checks are not done on
the packets.
Either destination port or source port or both can be specified in a udp-portlist entry.
EXAMPLES
modify udp-portlist dos-udp-portlist description "bad ports" list-type include-listed-ports Modifies the udp-portlist dos-
udp-portlist to a blacklist.
modify udp-portlist dos-udp-portlist list-type exclude-listed-ports Modifies the udp-portlist dos-udp-portlist to a white-
list.
modify udp-portlist dos-udp-portlist description "bad ports" entries modify { entry1 { match-direction src port-number 161
} } Modifies an entry. The new entry is for source UDP port 161. It matches any UDP packet whose source port is 161.
modify udp-portlist dos-udp-portlist entries modify { 161 { match-direction both } }
Modifies the entry for destination UDP port 161 to source and destination port 161. It matches any UDP packet whose
destination or source port is 161.
security dos udp-portlist dos-udp-portlist {
entries {
entry1 {
match-direction both
port-number snmp
}
entry2 { }
entry3 { }
entry4 { }
}
white-list
}
Displays the current list of DoS UDP portlist entries.
OPTIONS
description
Your description for the DoS udp-portlist.
list-type
Sets the list type to be either exclude-listed-ports or include-listed-ports
include-listed-ports
Sets the property of the dos-udp-portlist list to include-listed-ports (Blacklist).
exclude-listed-ports
Sets the property of the dos-udp-portlist list to exclude-listed-ports (Whitelist).
entries
Modifies a udp-portlist entry.
modify
Modifies the existing entry that you specify next, in curly braces ({}). After the entry name, enter the new
configuration (port mode and port number) settings for the entry inside a nested set of curly braces.
replace-all-with
Replaces the current set of udp-portlist entries with the entry(s) that you specify next, in curly braces ({}).
Enter the name of a entry to be modified, then enter an open curly brace ({), one or more of the following options,
and a closed curly brace (}).
description
Your description for the current entry.
match-direction
Set the mode of matching (source, destination or both).
port-number
Set the port number for matching.
SEE ALSO
edit, list, modify, security, security dos, tmsh
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording, or information storage and retrieval systems, for any purpose other than the purchaser's personal
use, without the express written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2008, 2012-2016. All rights reserved.
BIG-IP 2016-03-14 security dos udp-portlist(1)