1086drop: Drops subsequent SYN packets destined for the protected IP address.logging: Enables logging for SYN flood attack events.none: Takes no action.Usage guidelinesWith SYN flood attack detection configured for an IP address, the device is in attack detection state.When the sending rate of SYN packets to the IP address reaches the threshold, the device entersprevention state and takes the specified actions. When the rate is below the silence threshold(three-fourths of the threshold), the device returns to the attack detection state.Examples# Configure SYN flood attack detection for 192.168.1.2 in the attack defense policy atk-policy-1. system-view[Sysname] attack-defense policy atk-policy-1[Sysname-attack-defense-policy-atk-policy-1] syn-flood detect ip 192.168.1.2 threshold2000Related commandssyn-flood actionsyn-flood detect non-specificsyn-flood thresholdsyn-flood detect non-specificUse syn-flood detect non-specific to enable global SYN flood attack detection.Use undo syn-flood detect non-specific to disable global SYN flood attack detection.Syntaxsyn-flood detect non-specificundo syn-flood detect non-specificDefaultGlobal SYN flood attack detection is disabled.ViewsAttack defense policy viewPredefined user rolesnetwork-adminUsage guidelinesThe global SYN flood attack detection applies to all IP addresses except for those specified by thesyn-flood detect command. The global detection uses the global trigger threshold set by thesyn-flood threshold command and global actions specified by the syn-flood action command.Examples# Enable global SYN flood attack detection in the attack defense policy atk-policy-1. system-view[Sysname] attack-defense policy atk-policy-1[Sysname-attack-defense-policy-atk-policy-1] syn-flood detect non-specificRelated commandssyn-flood action
