Motorola AP-7131 Series, Reference Manual

Page: 574 / 954

8 - 4 WiNG 5.5 Access Point System Reference Guide
5. The following Events can be filtered on behalf of the firewall:
Action If a DoS filter is enabled, chose an action from the drop-down menu to determine how the
firewall treats the associated DoS attack. Options include:
• Log and Drop - An entry for the associated DoS attack is added to the log and then the
packets are dropped.
• Log Only - An entry for the associated DoS attack is added to the log. No further action
is taken.
• Drop Only - The DoS packets is dropped. No further action is taken.
Log Level Select this option to enable logging to the system log. Then select a standard Syslog level
from the
Log Level drop-down menu.
Ascend Ascend DoS attacks are a series of attacks that target known vulnerabilities in various
versions of Ascend routers.
Broadcast/
Multicast ICMP Broadcast or Multicast ICMP DoS attacks are a series of attacks that take advantage of
ICMP behavior in response to echo requests. These usually involve spoofing the source
address of the target and sending ICMP broadcast or multicast echo requests to the rest of
the network and in the process flooding the target machine with replies.
Chargen The Chargen attack establishes a Telnet connection to port 19 and attempts to use the
character generator service to create a string of characters which is then directed to the
DNS service on port 53 to disrupt DNS services.
Fraggle The Fraggle DoS attack uses a list of broadcast addresses to send spoofed UDP packets to
each broadcast address’ echo port (port 7). Each of those addresses that have port 7 open
will respond to the request generating a lot of traffic on the network. For those that do not
have port 7 open they will send an unreachable message back to the originator, further
clogging the network with more traffic.
FTP Bounce The FTP Bounce DoS attack uses a vulnerability in the FTP “PORT” command as a way to
scan ports on a target machine by using another machine in the middle.
Invalid Protocol Attackers may use vulnerability in the endpoint implementation by sending invalid protocol
fields, or may misuse the misinterpretation of endpoint software. This can lead to
inadvertent leakage of sensitive network topology information, call hijacking, or a DoS
attack.
TCP IP TTL Zero The TCP IP TTL Zero DoS attack sends spoofed multicast packets onto the network which
have a
Time To Live (TTL) of 0. This causes packets to loop back to the spoofed originating
machine, and can cause the network to overload.
IP Spoof IP Spoof is an attack that sends IP packets with forged source addresses. This can hide the
identity of the attacker.
LAND The LAND DoS attack sends spoofed packets containing the SYN flag to the target
destination using the target port and IP address as both the source and destination. This
will either crash the target system or result in high resource utilization slowing down all
other processes.
Option Route Enables the IP Option Route denial of service check in the firewall.