Editing Denial-of-service attack (section)

===Switches===
Most switches have some rate-limiting and [[access control list|ACL]] capability. Some switches provide automatic or system-wide [[rate limiting]], [[traffic shaping]], [[delayed binding]] ([[TCP splicing]]), [[deep packet inspection]] and [[bogon filtering]] (bogus IP filtering) to detect and remediate DoS attacks through automatic rate filtering and WAN Link failover and balancing. These schemes will work as long as the DoS attacks can be prevented by using them. For example, SYN flood can be prevented using delayed binding or TCP splicing. Similarly, content-based DoS may be prevented using deep packet inspection. Attacks using [[Martian packet]]s can be prevented using bogon filtering. Automatic rate filtering can work as long as set rate thresholds have been set correctly. WAN-link failover will work as long as both links have a DoS prevention mechanism.<ref name=":0" />