10
NX-Platform Hardware Installation and Safety
• Application-layer parsing of over 170 network protocols
The TSE reconstructs and inspects flow payloads by parsing the traffic at the application layer. As each new
packet of the traffic flow arrives, the engine re-evaluates the traffic for malicious content. The instant the
engine detects malicious traffic, it blocks all current and all subsequent packets pertaining to the traffic flow.
The blocking of the traffic and packets ensures that the attack never reaches its destination.
The combination of high-speed network processors and custom chips provides the basis for IPS technology.
These highly specialized traffic classification engines enable the IPS to filter with extreme accuracy at gigabit
speeds and microsecond latencies. Unlike software-based systems whose performance is affected by the
number of filters installed, the highly-scalable capacity of the hardware engine allows thousands of filters to
run simultaneously with no impact on performance or accuracy.
Threat Management Center
The Threat Management Center (TMC) is a centralized service center that monitors global threats and
distributes up-to-date attack filter packages, software updates, and product documentation.
The TMC collects threat information and creates Digital Vaccine packages that are made available on the
TMC website. The packages include filters that block malicious traffic and attacks on your network. The
filters provide the following protections:
•
Application Protection
— Defend against known and unknown exploits that target applications and
operating systems:
• Attack Protection filters — Detect and block traffic known to be malicious, suspicious, and to have
known security implications. These filters include vulnerabilities and exploits filters.
• Security Policy filters — Detect and block traffic that might or might not be malicious. This traffic
might be different in its format or content from standard business practice, aimed at specific
software or operating systems, or contrary to your company’s security policies.
• Reconnaissance filters — Detect and block scans, sweeps, and probes for vulnerabilities and
information about your network. These filters include probes and sweeps/scans filters.
• Informational filters — Detect and block classic Intrusion Detection System (IDS) infiltration.
•
Infrastructure Protection
— Protect network bandwidth and network infrastructure elements, such as
routers and firewalls, from attack using a combination of filter types:
• Network Equipment Protection filters — Protect networked equipment from attacks.
• Traffic Normalization filters — Detect and block abnormal or malicious traffic.
•
Performance Protection
— Allow key applications to have a prioritized bandwidth-access setting that
ensures mission-critical applications have adequate performance during times of high congestion:
• Misuse and Abuse filters — Protect the resources and usage of file sharing across networks and
personal computers. These filters protect peer-to-peer services.
