SignaMax 065-7434, Configuration Manual

Page: 282 / 669

282 SIGNAMAX LLC • www.signamax.eu
Attack Detection
Signamax 3400 switches possess the attack detection function to detect and defend the
common network attacks, such as IP Source Address spoofing attack, LAND attack, SYN
Flood attack, Smurf attack, Ping Flood attack, TearDrop attack and Netbios/Samba attack.
This function only takes effect for the packets need to be processed by the CPU of a
switch, is invalid for common service packets.
Pseudo-source Address Detection
Overview
Pseudo source address is a mean utilized most frequently by attackers. It is often used for
session hijacking and DOS attacking etc. Detection of this kind of packet is highly technical;
the most common detection is configuring the access list of the receiving direction on each
interface to filter packets. However, this kind of detection is very limited. The firewall function
strengthens and adds some other detection mechanisms for this aspect. The detection is not
omnipotent, not all such packets are legal, and also it doesn’t indicate that all detected
packets are illegal. The detection is processed in the following aspects:
1.
Whether the receiving interface is correct. If the interface which receives a packet doesn’t
has a route to achieve its source address and the route should depend on other interface,
the packet should be intercepted (even it is not the spoofing of the pseudo-source address,
it is abnormal);
2.
The route to achieve the source address of a packet cannot be found from the switch, the
packet should be intercepted;
3.
If it is a direct route according to the source address (and belongs to Ethernet) or interface
route, but cannot find the corresponding source IP address of the MAC address from the