資源描述：
《IP攻擊解決方案》由會員上傳分享，免費在線閱讀，更多相關(guān)內(nèi)容在行業(yè)資料-天天文庫。
1、在S7500E上禁止特定IP地址進入網(wǎng)絡(luò)的案例：system-viewSystemView:returntoUserViewwithCtrl+Z.[H3C]aclnumber2000#創(chuàng)建匹配源地址是6.14.5.2的IP報文。[H3C-acl-basic-2000]ruledenysource6.14.5.20[H3C-acl-basic-2000]quit[H3C]interfaceVlan-interface1#禁止ACL2000匹配的報文進入設(shè)備。（在靠近上行的接口下發(fā)）[H3C-Vlan-interface1]packet-filter2000
2、inbound[H3C-Vlan-interface1]quit反向跟蹤法查詢IP：PC收到一個源地址，會回包，回包就會經(jīng)過相同的路徑。1、查看PC的網(wǎng)關(guān)地址，找到作為PC網(wǎng)關(guān)的設(shè)備。C:UsersCallCenter>ipconfigWindowsIP配置以太網(wǎng)適配器本地連接:連接特定的DNS后綴.......:h3c.comIPv4地址............:10.XXX.XXX.XXX子網(wǎng)掩碼............:255.255.255.0默認網(wǎng)關(guān).............:10.XXX.XXX.XXX2、查看該設(shè)備的路由表，判定該數(shù)據(jù)報回程的時候
3、的路徑。3、在路徑的下一跳設(shè)備上繼續(xù)查找路由表項。displayiprouting-tableRoutingTables:PublicDestinations:11Routes:12Destination/MaskProtoPreCostNextHopInterface0.0.0.0/0Static60010.153.XX.1M-E1/0/0/010.153.XX.0/24Direct0010.153.XX.11M-E1/0/0/010.153.XX.11/32Direct00127.0.0.1InLoop0127.0.0.0/8Direct00127.
4、0.0.1InLoop0127.0.0.1/32Direct00127.0.0.1InLoop04、依次排查中間的每臺設(shè)備，發(fā)現(xiàn)下一跳是本機（127.0.0.1）的時候查看ARP表。displayiprouting-tableRoutingTables:PublicDestinations:11Routes:12Destination/MaskProtoPreCostNextHopInterface0.0.0.0Direct00192.168.1.1InLoop010.153.XX.0/21Static60010.153.XX.1M-E1/0/0/06.
5、1.5.0/26Direct00127.0.0.1M-E1/0/0/06.14.5.2/32Direct00127.0.0.1InLoop0127.0.0.0/8Direct00127.0.0.1InLoop0127.0.0.1/32Direct00127.0.0.1InLoop05、通過ARP表項找到對應(yīng)的出接口。displayarpallType:S-StaticD-DynamicM-MultiportIPAddressMACAddressVLANIDInterfaceAgingType6.14.5.20011-2233-4455N/AGE0/018
6、D……6、根據(jù)接口查找到二層交換機。7、根據(jù)MAC地址表找到接該PC的接口。displaymac-addressMACADDRVLANIDSTATEPORTINDEXAGINGTIME(s)0011-2233-44551LearnedGigabitEthernet1/0/1AGING0011-2233-44561LearnedGigabitEthernet1/0/1AGING8、最終在PC上查看MAC認定是否為該PC。C:UsersCallCenter>ipconfig/allWindowsIP配置主機名.............:CallCente
7、r-Ext主DNS后綴...........:節(jié)點類型............:混合IP路由已啟用..........:否WINS代理已啟用.........:否DNS后綴搜索列表........:h3c.com以太網(wǎng)適配器本地連接:連接特定的DNS后綴.......:h3c.com描述...............:Intel(R)82567LM-3GigabitNetworkConnection物理地址.............:00-11-22-33-44-55DHCP已啟用...........:是自動配置已啟用..........:是IPv4地址....
8、.....
