3-2
Virus Throttling (Connection-Rate Filtering)
Overview of Connection-Rate Filtering
connection-rate filtering can help reduce the impact of worm-like malicious
code and give system administrators more time to isolate and eradicate the
threat. Thus, while traditional worm and virus-signature updates will still
need to be deployed to hosts, the network remains functional and the overall
distribution of the malicious code is limited.
Features and Benefits
Connection-rate filtering is a countermeasure tool you can use in your inci-
dent-management program to help detect an manage worm-type IT security
threats received in inbound IP traffic. Major benefits of this tool include:
■
Behavior-based operation that does not require identifying details
unique to the code exhibiting the worm-like operation.
■
Handles unknown worms.
■
Needs no signature updates.
■
Protects network infrastructure by slowing or stopping IP traffic from
hosts exhibiting high connection-rate behavior.
■
Allows network and individual switches to continue to operate, even
when under attack.
■
Provides Event Log and SNMP trap warnings when worm-like
behavior is detected
■
Gives IT staff more time to react before the threat escalates to a crisis.
Summary of Contents for E3800 Series
Page 2: ......
Page 3: ...HP Networking E3800 Switches Access Security Guide September 2011 KA 15 03 ...
Page 30: ...xxviii ...
Page 86: ...2 36 Configuring Username and Password Security Password Recovery ...
Page 186: ...4 72 Web and MAC Authentication Client Status ...
Page 364: ...8 32 Configuring Secure Shell SSH Messages Related to SSH Operation ...
Page 510: ...10 130 IPv4 Access Control Lists ACLs General ACL Operating Notes ...
Page 548: ...11 38 Configuring Advanced Threat Protection Using the Instrumentation Monitor ...
Page 572: ...12 24 Traffic Security Filters and Monitors Configuring Traffic Security Filters ...
Page 730: ...20 Index ...
Page 731: ......