Eicon Networks SHIVA 1100, Administrator'S Manual, Page: 60 / 136

Intrusion detection
60 System Administrator’s Guide
The following figure shows the Intrusion Detection and Blocking (IDB) configuration
page:
The trigger count specifies the number of times a host is permitted to attempt to
connect to a monitored service before being blocked. This option only takes effect
when one of the previous blocking options is enabled. The trigger count value should
be between 0 and 2 (o represents an immediate blocking of probing hosts). Larger
settings mean more attempts are permitted before blocking and although allowing the
attacker more latitude, these settings will reduce the number of false positives.
The ignore list contains a list of host IP addresses which the IDB will ignore for
detection and blocking purposes. This list may be freely edited so trusted servers and
hosts are not blocked. The two addresses 0.0.0.0 and 127.0.0.1 cannot be removed
from the ignore list because they represent the IDB host. You may enter the IP
addresses as a range, see the IP address ranges section further on for more
information.
Warning: A word of caution regarding automatically blocking UDP requests.
Because an attacker can easily forge the source address of these requests, a host
that automatically blocks UDP probes can be tricked into restricting access from
legitimate services. Proper firewall rules and ignored hosts lists will significantly
reduce this risk.