blocking packet with ttl 1 or 0 on 6509

[athambi]

I am using a cisco  609 with  sup 720 and PFC3 card .I was wondering if there is way to  block the packet that  hits the  6509 with ttl1 vlaue of 1 or 0 .

Ajai

[francisco_1]

You could use TTL filtering in ACLs to filter packets with specific TTL value to protect the local device and downstream from TTL expiry attack

Or on the 6500 you could use hardware-based rate limiters to protect the local device from TTL expiry attacks.

Flexible packet matching can be used to filter on specific fields within the IP packet hearders including TTL value.

Francisco

[francisco_1]

See this http://conft.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd802ca5d6.html

and http://www.cisco.com/web/about/security/intelligence/ttl-expiry.html

Francisco