Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

show security screen ids-option

Syntax

Description

Display the configuration information about the specified security screen. You can configure a ids-option to enable screen protection on the SRX Series devices.

Options

  • screen-name —Name of the screen.

  • logical-system—Name of the logical system.

  • root-logical-system—Displays root logical system as default.

  • tenant—Name of the tenant system.

Required Privilege Level

view

Output Fields

Table 1 lists the output fields for the show security screen ids-option command. Output fields are listed in the approximate order in which they appear.

Table 1: show security screen ids-option Output Fields

Field Name

Field Description

TCP address sweep threshold

Number of microseconds for which the device accepts 10 TCP packets from the same remote source to different destination addresses.

TCP port scan threshold

Number of microseconds during which the device accepts packets from the same remote source with up to 10 different port numbers.

ICMP address sweep threshold

Number of microseconds during which up to 10 ICMP echo requests from the same host are allowed into the device.

UDP flood threshold

Number of UDP packets per second allowed to ping the same destination address before the device rejects further UDP packets.

UDP port scan threshold

Number of microseconds during which the device accepts packets from the same remote source IP with up to 10 different destination port numbers.

TCP winnuke

Enable or disable the detection of TCP WinNuke attacks.

TCP SYN flood attack threshold

Number of SYN packets per second required to trigger the SYN proxy response.

TCP SYN flood alarm threshold

Number of half-complete proxy connections per second at which the device makes entries in the event alarm log.

TCP SYN flood source threshold

Number of SYN segments to be received per second before the device begins dropping connection requests.

TCP SYN flood destination threshold

Number of SYN segments received per second before the device begins dropping connection requests.

TCP SYN flood timeout

Maximum length of time before a half-completed connection is dropped from the queue.

TCP SYN flood queue size

Number of proxy connection requests that can be held in the proxy connection queue before the device begins rejecting new connection requests.

ICMP large packet

Enable or disable the detection of any ICMP frame with an IP length greater than 1024 bytes.

UDP address sweep threshold

Number of microseconds for which the device accepts 10 UDP packets from the same remote source to different destination addresses.

IPv6 extension routing

Enable or disable the IPv6 extension routing screen option.

IPv6 extension shim6

Enable or disable the IPv6 extension shim6 screen option.

IPv6 extension fragment/IP block fragment

Enable or disable the IPv6 extension fragment screen option.

IPv6 extension AH

Enable or disable the IPv6 extension Authentication Header Protocol screen option.

IPv6 extension ESP

Enable or disable the IPv6 extension Encapsulating Security Payload screen option.

IPv6 extension mobility

Enable or disable the IPv6 extension mobility screen option.

IPv6 extension HIP

Enable or disable the IPv6 extension Host Identify Protocol screen option.

IPv6 extension no next

Enable or disable the IPv6 extension no-next screen option.

IPv6 extension user-defined

Enable or disable the IPv6 extension user-defined screen option.

IPv6 extension HbyH jumbo

Enable or disable the IPv6 extension HbyH jumbo screen option.

IPv6 extension HbyH RPL

Enable or disable the IPv6 extension HbyH RPL screen option.

IPv6 extension HbyH router alert

Enable or disable the IPv6 extension HbyH router screen option.

IPv6 extension HbyH quick start

Enable or disable the IPv6 extension HbyH quick-start screen option.

IPv6 extension HbyH CALIPSO

Enable or disable the IPv6 extension HbyH Common Architecture Label IPv6 Security Screen option.

IPv6 extension HbyH SMF DPD

Enable or disable the IPv6 extension HbyH Simplified Multicast Forwarding IPv6 Duplicate Packet Detection screen option.

IPv6 extension HbyH user-defined

Enable or disable the IPv6 extension HbyH user-defined screen option.

IPv6 extension Dst tunnel encap limit

Enable or disable the IPv6 extension distributed (network) storage tunnel encapsulation limit screen option.

IPv6 extension Dst home address

Enable or disable the IPv6 extension DST home address screen option.

IPv6 extension Dst ILNP nonce

Enable or disable the IPv6 extension DST Identifier-Locator Network Protocol nonce screen option.

IPv6 extension Dst line-id

Enable or disable the IPv6 extension DST line-ID screen option.

IPv6 extension Dst user-defined

Enable or disable the IPv6 extension DST user-defined screen option.

IPv6 extension header limit

Threshold for the number of IPv6 extension headers that can pass through the screen.

IPv6 malformed header

Enable or disable the IPv6 malformed header screen option.

ICMPv6 malformed header

Enable or disable the ICMPv6 malformed packet screen option.

UDP flood white-list

Whitelist of IP addresses to bypass UDP flood detection.

Session source limit threshold

Limit the number of concurrent sessions the device can initiate from a single source IP address or the number of sessions it can direct to a single destination IP address.

Logical system/Tenant

Name of the logical system or tenant system.

Sample Output

show security screen ids-option jscreen

Sample Output

show security screen ids-option jscreen (IPv6)

Sample Output

show security screen ids-option jscreen1 node all

show security screen ids-option jscreen tenant TN1

show security screen ids-option jscreen tenant all

Release Information

Command introduced in Junos OS Release 8.5. Support for UDP port scan added in Junos OS Release 12.1X47-D10.

Support for node option added in Junos OS Release 9.0.

Support for IPv6 extension header screens added in Junos OS Release 12.1X46-D10.

The tenant option is introduced in Junos OS Release 18.3R1.