Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 395 / 1016

firewall rule that contains this attack object to monitor traffic on the standard service
port or ICMP ID.
• RPC—The remote procedure call (RPC) protocol is used by distributed processing
applications to handle interaction between processes remotely. When a client makes
a remote procedure call to an RPC server, the server replies with a remote program;
each remote program uses a different program number. To detect attacks that use
RPC, configure the service binding as RPC and specify the RPC program ID.
•
Service—Most attacks use a specific service to attack your network. If you select Service
as the service binding, you must select the specific service used to perpetrate the
attack. Additionally, you are restricted to general attack contexts (packet, first packet,
stream, stream 256, or line context). To detect these attacks, configure the service
binding to match the attack service. See Table 35 on page 345.
Table 35: Supported Services for Service Bindings
Default Port Description Service
AOL Instant Messenger AIM
TCP/19, UDP/19 Chargen Chargen
Dynamic Host Configuration Protocol DHCP
TCP/9, UDP/9 Discard Discard
TCP/53, UDP/53 Domain Name Service DNS
TCP/7, UDP/7 Echo Echo
TCP/79, UDP/79 Finger Information Protocol Finger
TCP/21, UDP/21 File Transfer Protocol FTP
Gnutella Gnutella
Gopher Gopher
TCP/80, UDP/80 Hypertext Transfer Protocol HTTP
Internet Control Message Protocol ICMP
TCP/113 IDENT IDENT
TCP/143, UDP/143 Internet Message Access Protocol IMAP
Internet Relay Chat IRC
Lightweight Directory Access Protocol LDAP
Line Printer spooler lpr
345 Copyright © 2010, Juniper Networks, Inc.
Chapter 8: Configuring Objects