Session4CaseStudy.pptVIP

Session 4Case Study Discussion NBAR Remote Triggered Black Hole Phishing Routing Security Discussion NBAR NBAR class-map match-any codered match protocol http url *default.ida* match protocol http url *cmd.exe* match protocol http url *root.exe* policy-map mark-codered class codered set ip dscp 1 int s 0 service-policy input mark-codered access-list 100 deny ip any any dscp 1 access-list 100 permit ip any any int e 0 ip access-group 100 out Remote Triggered Black Hole Lab Phishing 事件起因：我们接到国外投诉，IP地址AAA.AAA.AAA.AAA 上面存在钓鱼网站，访问该地址发现是，该网站是某校电子系的主