Freedom9 freeGuard Capture 1000, User Manual

Page: 81 / 107

freeGuard Capture Appliance User’s Manual
77
9 Anomaly Flow IP
When the corporate network is under a DoS (or DDoS) attack, the ICR appliance will take
actions (such as sending alerts) to protect the internal network.
This chapter will be discussing the functionality and application of Anomaly Flow IP.
Figure 77, Anomaly flow IP menu
Overview
z
Threshold sessions of anomaly flow (per Source IP)
Threshold value to identify the anomaly flow.
z
Anomaly Flow IP Blocking
Block the IP which generates the Anomaly flow.
z
Alert Notification
Send the alerts by email and/or NetBIOS message.
z
Co-Defense System
The ICR appliance is able to cooperate with a core switch to against anomaly flow,
protecting corporate network from being paralyzed.
z
Non-detected IP
If a local server is known as a service provider, not an anomaly flow IP, then this
server can be classified as a non-detected IP.