![background image](http://html1.mh-extra.com/html/zyxel-communications/p-660h-61/p-660h-61_user-manual_944041164.webp)
Chapter 10 Firewall
ADSL Router Series User’s Guide
164
• Use the
DoS
screen (
) to set the thresholds that the ZyXEL Device uses
to determine when to start dropping sessions that do not become fully established (half-open
sessions).
10.1.2 What You Need to Know About Firewall
SYN Attack
A SYN attack floods a targeted system with a series of SYN packets. Each packet causes the
targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that
follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on a backlog queue. SYN-
ACKs are moved off the queue only when an ACK comes back or when an internal timer terminates
the three-way handshake. Once the queue is full, the system will ignore all incoming SYN requests,
making the system unavailable for legitimate users.
DoS
Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the
Internet. Their goal is not to steal information, but to disable a device or network so users no longer
have access to network resources. The ZyXEL Device is pre-configured to automatically detect and
thwart all known DoS attacks.
DDoS
A Distributed DoS (DDoS) attack is one in which multiple compromised systems attack a single
target, thereby causing denial of service for users of the targeted system.
LAND Attack
In a Local Area Network Denial (LAND) attack, hackers flood SYN packets into the network with a
spoofed source IP address of the target system. This makes it appear as if the host computer sent
the packets to itself, making the system unavailable while the target system tries to respond to
itself.
Ping of Death
Ping of Death uses a "ping" utility to create and send an IP packet that exceeds the maximum
65,536 bytes of data allowed by the IP specification. This may cause systems to crash, hang or
reboot.
SPI
Stateful Packet Inspection (SPI) tracks each connection crossing the firewall and makes sure it is
valid. Filtering decisions are based not only on rules but also context. For example, traffic from the
WAN may only be allowed to cross the firewall in response to a request from the LAN.
RFC 4890 SPEC Traffic
RFC 4890 specifies the filtering policies for ICMPv6 messages. This is important for protecting
against security threats including DoS, probing, redirection attacks and renumbering attacks that
Summary of Contents for P-660H-61
Page 2: ......
Page 6: ...Document Conventions ADSL Router Series User s Guide 6 Server Firewall Telephone Router Switch...
Page 8: ...Safety Warnings ADSL Router Series User s Guide 8...
Page 10: ...Contents Overview ADSL Router Series User s Guide 10...
Page 20: ...Table of Contents ADSL Router Series User s Guide 20...
Page 21: ...21 PART I User s Guide...
Page 22: ...22...
Page 28: ...Chapter 1 Introduction ADSL Router Series User s Guide 28...
Page 40: ...Chapter 3 Status Screens ADSL Router Series User s Guide 40...
Page 76: ...Chapter 4 Tutorials ADSL Router Series User s Guide 76...
Page 77: ...77 PART II Technical Reference...
Page 78: ...78...
Page 150: ...Chapter 8 Wireless LAN ADSL Router Series User s Guide 150...
Page 198: ...Chapter 13 Static Route ADSL Router Series User s Guide 198...
Page 202: ...Chapter 14 Port Binding ADSL Router Series User s Guide 202...
Page 208: ...Chapter 15 802 1Q 1P ADSL Router Series User s Guide 208...
Page 258: ...Chapter 21 Sharing a USB Printer ADSL Router Series User s Guide 258...
Page 262: ...Chapter 22 CWMP ADSL Router Series User s Guide 262...
Page 266: ...Chapter 23 System Settings ADSL Router Series User s Guide 266...
Page 270: ...Chapter 24 Logs ADSL Router Series User s Guide 270...
Page 326: ...Appendix C Pop up Windows JavaScripts and Java Permissions ADSL Router Series User s Guide 326...
Page 340: ...Appendix D Wireless LANs ADSL Router Series User s Guide 340...
Page 350: ...Appendix E IPv6 ADSL Router Series User s Guide 350...
Page 362: ...Appendix G Legal Information ADSL Router Series User s Guide 362...