Freedom9 freeGuard Capture 1000, User Manual

Page: 82 / 107

78
Anomaly Flow IP Setting
When the number of concurrent sessions from an IP address has exceeded the threshold,
ICR appliance will treat the IP address as an anomaly flow IP, block data sent from it and
send out email alert notification to designated email address.
If the “Enable Anomaly Flow IP Blocking” is checked, all sessions created by an anomaly
flow IP will be dropped to ensure the Internet access for other users.
Figure 78, Anomaly flow detect - general settings
If the Email alert notification is enabled, The victim user and system administrator will
receive an alert by e-mail or NetBIOS notification when an anomaly flow is detected.