agentsclimarketplace

Attack defense

Skill nanxiaoyao/network-huawei-skills/attack-defense

Huawei network device (USG firewall + S/CE switch) CLI skills pack for OpenClaw AI agent — also usable as a standalone cheatsheet.

Install
npx -y skills add nanxiaoyao/network-huawei-skills --skill attack-defense

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

This skill should be used when the user asks to configure or troubleshoot Huawei USG6000E firewall attack defense features. Covers Anti-DDoS (SYN/UDP/HTTP flood), single-packet attack defense, URPF source-address validation, per-IP connection rate limiting, traffic-based dynamic CAR, and SACG admission control linkage. Applicable platforms USG6000E V600R007C20+ and USG6000/USG9500/NGFW Module V500R005C20+ (CLI syntax identical between versions).

SKILL.md

6.9 KB, ~2.0k tokens by cl100k_base, as published. Nobody here has run it

华为 USG 攻击防范配置技能 (attack-defense)

适用平台 USG6000E 系列 适用版本 V600R007C20+ 文档来源 HUAWEI USG6000E V600R007C20 产品文档 (案例 sec_case_defend_*)

USG 攻击防范分三层 单包攻击防范（畸形/扫描类）+ 流量型攻击防范（DDoS）+ 应用层攻击防范（HTTP/DNS Flood）

触发场景

  • 公网链路被刷流量 怀疑 DDoS
  • 服务器 syn-flood / udp-flood 攻击
  • 应用层 HTTP-flood CC 攻击
  • 配置源地址校验 防 IP 欺骗
  • 限制单 IP 新建连接数 防爬虫/扫描
  • 联动 IDS/HiSec Insight 做高级威胁防御
  • 终端准入 SACG 联动

防护体系全景

┌───────────────────────────────────────────────────┐
│ 应用层  HTTP-Flood / DNS-Flood / SIP-Flood        │
│  ├─ 指纹学习  dynamic-fingerprint-learn          │
│  └─ 源认证    source-detect                       │
├───────────────────────────────────────────────────┤
│ 流量层  SYN/UDP/ICMP Flood + 动态限流             │
│  ├─ alert-rate 阈值告警                           │
│  ├─ defend 启用清洗                               │
│  └─ auto-defend 动态 CAR                          │
├───────────────────────────────────────────────────┤
│ 单包层  畸形包 IP/TCP options 扫描                │
│  └─ firewall defend XXX enable                    │
├───────────────────────────────────────────────────┤
│ 入口层  URPF 反向路径校验 防 IP 欺骗              │
└───────────────────────────────────────────────────┘

一 Anti-DDoS 防 DDoS

配置三步走

  1. 接口启用流量统计 anti-ddos flow-statistic enable
  2. 启用基线学习 自适应阈值 anti-ddos baseline-learn start
  3. 配置各攻击类型 alert/defend

经典模板 来自 sec_case_defend_0005

system-view
interface GigabitEthernet 0/0/1
 anti-ddos flow-statistic enable
 quit
anti-ddos syn-flood source-detect
anti-ddos syn-flood defend alert-rate 3000
anti-ddos udp-flood dynamic-fingerprint-learn alert-speed 80
anti-ddos udp-frag-flood dynamic-fingerprint-learn alert-speed 50
anti-ddos http-flood defend alert-rate 9000
anti-ddos http-flood source-detect mode basic
anti-ddos baseline-learn tolerance-value 100
anti-ddos baseline-learn start

阈值原则

  • 业务峰值 ×3 作为 alert-rate
  • 先观察 1-2 周 学习基线 再开 defend
  • tolerance-value 100 表示允许超基线 100%

二 单包攻击防范

适用：畸形包 land smurf fraggle teardrop 端口扫描 IP-Sweep TCP options

firewall defend land enable
firewall defend smurf enable
firewall defend fraggle enable
firewall defend tcp-flag enable
firewall defend ip-fragment enable
firewall defend ip-spoofing enable
firewall defend route-record enable
firewall defend source-route enable
firewall defend ip-sweep enable
 firewall defend ip-sweep max-rate 5000 blacklist-timeout 20
firewall defend port-scan enable
 firewall defend port-scan max-rate 4000 blacklist-timeout 20

三 URPF 反向路径校验

防伪源地址 防地址欺骗 IP-spoofing

IPv4

interface GigabitEthernet 0/0/1
 ip urpf { strict | loose } [ allow-default-route ] [ acl <num> ]

IPv6

interface GigabitEthernet 0/0/1
 ipv6 enable
 ipv6 address 2002::2 64
 ipv6 urpf { strict | loose } [ allow-default-route ] [ acl6 <num> ]

模式选择：

  • strict 严格 入接口必须是该源地址回包的最优出接口（适合 ISP 边界）
  • loose 宽松 路由表里有该源即可（适合不对称路由场景）

四 流量型攻击动态限流 auto-defend CAR

适用：检测到攻击源后 自动对其限速 不影响整体业务

anti-ddos auto-defend traffic-policy enable
anti-ddos auto-defend car 50000               # 限速值 单位 bps
anti-ddos auto-defend base-session enable     # 启用会话基线
anti-ddos auto-defend base-session alert-rate 100000 max-rate 200000

五 每 IP 新建连接限速

防爬虫 慢速扫描

firewall statistic system enable
ip-link check enable
firewall session aging-time service-set <service> <s>

# 创建限速对象
firewall ip-link 1 destination <ip>
# 或基于策略限速
security-policy
 rule name limit_per_source
  source-zone untrust
  destination-zone trust
  action permit
  session aging-time 60

更细粒度：

firewall session link-state check
firewall defend connection-limit enable
firewall defend connection-limit max-num <num>

六 SACG 终端准入联动

USG 作为安全接入控制网关 联动 Agile Controller 做终端合规

旁挂模式（sec_case_defend_0022）：

right-manager server-group
 server authentication 10.1.1.1 1645 shared-key cipher Admin@123
 server authentication source ip 192.168.10.1
 default authentication policy permit
right-manager
 firewall id 5

直路模式（sec_case_defend_0023）：在所有终端流量必经接口启用

七 查看与诊断

命令说明
display anti-ddos statistics总览攻击统计
display anti-ddos baseline-learn information基线学习状态
display anti-ddos syn-flood defendSYN flood 防御状态
display anti-ddos http-flood defendHTTP flood 防御
display anti-ddos abnormal source-ip异常源 IP 列表
display firewall blacklist item黑名单
display firewall statistic system系统级会话/速率统计
display ip urpfURPF 状态
display firewall defend flag单包防御开启情况

八 常见陷阱

  • 没启 anti-ddos flow-statistic enable 就开防御 → 看不到攻击源
  • alert-rate 设太低 → 误杀正常业务 必须先学基线
  • URPF strict 用在不对称路由 → 合法流量被丢
  • HTTP-flood source-detect basic 在 CDN/反向代理后 → 把代理 IP 当攻击源 用 advanced 模式
  • 黑名单超时 blacklist-timeout 设太长 → 误判恢复慢 建议先 30s

相关文件

  • references/defend-commands.md 完整命令速查
  • references/defend-troubleshooting.md 防御误判与调优

Gives 0 of the 12 instructions most security skills give in ~2.0k tokens

Counted across 648 of the 828 authors here whose files we hold, read 2026-08-06

  • parameterize all database queriesin 67 of 648, across 49 files
  • hash passwords using bcrypt scrypt or argon2in 48 of 648, across 35 files
  • apply rate limiting to authentication endpointsin 48 of 648, across 24 files
  • Configure security headersin 35 of 648, across 18 files
  • validate all inputsin 32 of 648, across 24 files
  • validate all external input at the system boundaryin 29 of 648, across 18 files
  • run containers as a non-root userin 28 of 648, across 15 files
  • use httponly secure samesite cookies for sessionsin 26 of 648, across 15 files
  • run dependency audits before every releasein 21 of 648, across 10 files
  • encode output to prevent cross-site scriptingin 21 of 648, across 10 files
  • copy dependencies before source codein 20 of 648, across 9 files
  • store secrets in environment variablesin 20 of 648, across 17 files

Said here and by no other author read

  • Calculate alert-rate at three times peak traffic
  • Observe baseline for two weeks before defending
  • Enable flow-statistics before enabling defenses
  • Set alert-rates for syn, udp, and http floods
  • Enable single-packet attack defenses globally
  • Set urpf strict at ISP boundaries

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.