Security Measures
182
Instruction Manual - NXA-ENET8-POE+
DoS Protection
Use the Security > DoS Protection page to protect against denial-of-service (DoS) attacks. A DoS attack is an attempt to block the
services provided by a computer or network resource. This kind of attack tries to prevent an Internet site or service from
functioning efficiently or at all. In general, DoS attacks are implemented by either forcing the target to reset, to consume most of
its resources so that it can no longer provide its intended service, or to obstruct the communication media between the intended
users and the target so that they can no longer communicate adequately. This section describes how to protect against DoS
attacks.
The following table lists the options on this page:
Perform these steps to protect against DoS attacks:
1.
Click
Security
>
DoS Protection
.
2.
Enable protection for specific DoS attacks, and set the maximum allowed rate as required.
3.
Click
Apply
.
Security - DoS Protection Options
Smurf Attack
Attacks in which a perpetrator generates a large amount of spoofed ICMP Echo Request traffic to
the broadcast destination IP address (255.255.255.255), all of which uses a spoofed source
address of the intended victim. The victim should crash due to the many interrupts required to
send ICMP Echo response packets. (Default: Disabled)
TCP Null Scan
A TCP NULL scan message is used to identify listening TCP ports. The scan uses a series of
strangely configured TCP packets which contain a sequence number of 0 and no flags. If the
target's TCP port is closed, the target replies with a TCP RST (reset) packet. If the target TCP port
is open, it simply discards the TCP NULL scan. (Default: Disabled)
TCP-SYN/FINScan
A TCP SYN/FIN scan message is used to identify listening TCP ports. The scan uses a series of
strangely configured TCP packets which contain SYN (synchronize) and FIN (finish) flags. If the
target's TCP port is closed, the target replies with a TCP RST (reset) packet. If the target TCP port
is open, it simply discards the TCP SYN FIN scan. (Default: Disabled)
TCPXmasScan
A so-called TCP XMAS scan message is used to identify listening TCP ports. This scan uses a series
of strangely configured TCP packets which contain a sequence number of 0 and the URG, PSH and
FIN flags. If the target's TCP port is closed, the target replies with a TCP RST packet. If the target
TCP port is open, it simply discards the TCP XMAS scan. (Default: Disabled)
FIG. 212
Protecting Against DoS Attacks