Andrisoft wanguard 6.2, User Manual

Page: 35 / 131

Wanguard 6.2 User Guide Configuration » Network & Policy » IP Zone
Anomaly Detection Settings & Threshold Templates
Define traffic threshold rules by adding them to the Thresholds panel from the IP Zone Configuration
window. To ease the addition of identical thresholds for multiple prefixes, add them to a Threshold Template instead,
by clicking Configuration » Network & Policy » <+> » Threshold Template.
A threshold rule contains the following metrics:
●
Domain – Sensors can detect anomalies to/from an IP contained in the subnet, or to/from the subnet as
a whole.
●
Direction – The direction of traffic can be “receives” for the inbound traffic that enters the prefix, or
“sends” for the outbound traffic that leaves the prefix.
●
Comparison – Select “over” for volumetric anomalies (e.g. DrDoS, DDoS) or “under” to detect missing
traffic towards a monitored subnet.
●
Value – Enter the threshold value as an absolute number or as a percentage of the total traffic received
by Sensor, for the selected decoder. Absolute values can be multiples of 1000 with K (kilo) appended,
multiples of 1 million with M (mega) appended, or multiples of 1 billion with G (giga) appended.
●
Decoder – Select one of the decoders enabled in Configuration » Anomaly Detection (see page 23).
●
Unit – DDoS attacks usually reach a very high number of packets per second, so select “pkts/s” to detect
them. For bandwidth-related anomalies, select “bits/s”.
●
Response – Select a previously defined Response, or select “None” to have no reaction to anomalies
other than displaying them in Reports » Tools » Anomalies » Active Anomalies.
●
Parent – Select “Yes” if more specific prefixes should inherit the threshold. You can cancel inherited
thresholds by defining a similar threshold with “Unlimited” selected in the Value field.
●
Inheritance – Displays the parent prefix if the rule was inherited from a less specific prefix.
Adding a threshold rule on 0.0.0.0/0 that reads, “Any IP receives over 5% TCP+SYN pkts/s” catches port scans
and all significant SYN attacks towards any IP address belonging to your network. A threshold rule on 0.0.0.0/0 that
reads, “Subnet sends under 1 TOTAL bits/s” executes the Response when the link goes down.
Best practices for setting up traffic thresholds for IPs:
✔
TCP+SYN thresholds should be configured to low values, around 500-1000 packets/s. TCP uses packets
with the SYN flag set only for establishing new TCP connections, and few services (e.g. very high volume
websites) can handle more than 1000 new connections every second. SYN packets are frequently used
for flooding.
✔
TCP bits/s thresholds should be configured to your maximum bandwidth level per IP. TCP packets carry
on average around 500 bytes of data. Setting a threshold of 15k TCP packets/s should be enough for
medium-sized networks.
✔
ICMP thresholds should be configured to very low levels, 50-100 packets/s. ICMP is frequently used for
flooding.
✔
UDP traffic has high packets/s but low bits/s, so you can configure low thresholds for bits/s. Setting UDP
- 35 -