ZyXEL Communications VSG1432-B101 - V1.10, Manual

Page: 216 / 408

Chapter 16 Firewall
VSG1432-B101 Series User’s Guide
216
16.1.2 What You Need to Know
SYN Attack
A SYN attack floods a targeted system with a series of SYN packets. Each packet
causes the targeted system to issue a SYN-ACK response. While the targeted
system waits for the ACK that follows the SYN-ACK, it queues up all outstanding
SYN-ACK responses on a backlog queue. SYN-ACKs are moved off the queue only
when an ACK comes back or when an internal timer terminates the three-way
handshake. Once the queue is full, the system will ignore all incoming SYN
requests, making the system unavailable for legitimate users.
DoS
Denials of Service (DoS) attacks are aimed at devices and networks with a
connection to the Internet. Their goal is not to steal information, but to disable a
device or network so users no longer have access to network resources. The
ZyXEL Device is pre-configured to automatically detect and thwart all known DoS
attacks.
DDoS
A DDoS attack is one in which multiple compromised systems attack a single
target, thereby causing denial of service for users of the targeted system.
LAND Attack
In a LAND attack, hackers flood SYN packets into the network with a spoofed
source IP address of the target system. This makes it appear as if the host
computer sent the packets to itself, making the system unavailable while the
target system tries to respond to itself.
Ping of Death
Ping of Death uses a "ping" utility to create and send an IP packet that exceeds
the maximum 65,536 bytes of data allowed by the IP specification. This may
cause systems to crash, hang or reboot.
SPI
Stateful Packet Inspection (SPI) tracks each connection crossing the firewall and
makes sure it is valid. Filtering decisions are based not only on rules but also
context. For example, traffic from the WAN may only be allowed to cross the
firewall in response to a request from the LAN.