The following example demonstrates the configuration of MSS notifications using ACL rules. In this example, smurf packets (ICMP packets that are sent to a limited broadcast destination) arriving at interface VLAN 203 are defined as a DoS attack to be reported in MSS notifications.

//create and enter the configuration mode of access control list 301:
Gxxx-001(super)# ip access-control-list 301
//create and enter the configuration mode of ip rule 1:
Gxxx-001(super-ACL 301/ip rule 1)# ip-rule 1
//set the rule criteria for the custom DoS classification:
//use dos-classification command to specify to report on receiving smurf 
//packets (ICMP echo packets with limited broadcast destination address )
Gxxx-001(super-ACL 301/ip rule 1)# dos-classification smurf
Done!
//apply predefined composite-operation deny-notify, which drops the packet and 
//causes the gateway to send a trap when it drops the packet
Gxxx-001(super-ACL 301)# composite-operation Deny-Notify
Done!
//specify that the ip rule applies to packets with this destination ip address.
Gxxx-001(super-ACL 301/ip rule 1)# destination-ip 255.255.255.255 0.0.0.0
Done!
//Specify that the ip rule applies to ICMP packets
Gxxx-001(super-ACL 301/ip rule 1)# ip-protocol icmp
Done!
Gxxx-001(super-ACL 301/ip rule 1)# exit
Gxxx-001(super-ACL 301)# show ip-rule 
Index  Protocol    IP               Wildcard    Port         Operation
       DSCP                                                  Fragment rule
----- -------- --- ---------------- ----------- ------------ --------------
1      icmp    Src Any                          Any Type     Deny-Notify
       Any     Dst 255.255.255.255  Host        Any Code     No
Dos classification: smurf 
Deflt  Any     Src Any                          Any          Permit
       Any     Dst Any                          Any          No 
Gxxx-001(super-ACL 301)# exit 
Gxxx-001(super)# interface vlan 203
//activate Access Control list 301 for incoming packets on interface vlan 203:
Gxxx-001(super-if:VLAN 203)# ip access-group 301 in
Done!