Nokia IP60 - Security Appliance, User Manual

Page: 297 / 494

SmartDefense Categories
Chapter 13: Using SmartDefense 297
FTP Bounce
When connecting to an FTP server, the client sends a PORT command specifying the IP address and port to
which the FTP server should connect and send data. An FTP Bounce attack is when an attacker sends a
PORT command specifying the IP address of a third party instead of the attacker's own IP address. The FTP
server then sends data to the victim machine.
You can configure how FTP bounce attacks should be handled.
Table 75: FTP Bounce Fields
In this field… Do this…
Action Specify what action to take when an FTP Bounce attack occurs, by selecting
one of the following:
Block.
Block the attack. This is the default.
None.
No action.
Track Specify whether to log FTP Bounce attacks, by selecting one of the
following:
Log.
Log the attack. This is the default.
None.
Do not log the attack.
Block Known Ports
You can choose to block the FTP server from connecting to well-known ports.
Note:
Known ports are published ports associated with services (for example, SMTP
is port 25).