3Com SUPERSTACK 3CR16110-95, User Manual, Page: 82 / 214

82 C
HAPTER
6: U
SING THE
F
IREWALL
D
IAGNOSTIC
T
OOLS
When ActiveX or Java code is compressed into an archive it is not always
possible to differentiate between the two. If either ActiveX or Java
blocking is enabled, all code archives are blocked.
Cookie blocked
The IP addresses of the local machine and the remote server are shown.
Ping of Death, IP Spoof, and SYN Flood Attacks
The IP address of the destination machine which may be under attack, as
well as the source address which appears in the packet are shown. In
these attacks, the source address shown is usually fake and usually
cannot be used to determine the source of the attack.
Varying conditions on the Internet can produce conditions which may
cause the appearance of an attack, even when no-one is deliberately
attacking one of the machines on the LAN or DMZ. This is particularly
true for SYN Flood attacks. If the log message calls the attack ”possible”,
or it only happens on an irregular basis, then there is probably no attack
in progress. If the log message calls the attack ”probable”, contact the ISP
to see if they can track down the source of the attack. In either case, the
LAN and DMZ are protected and you do not need to take further steps.
Changing Log and
Alert Settings
Click Log and then select the Log Settings tab. A window similar to that
in Figure 35 displays.
Figure 35 Log Settings Window
DUA1611-0AAA02.book Page 82 Thursday, August 2, 2001 4:01 PM