ZyXEL Communications ZyWALL 35 Series, User Manual

Page: 541 / 872

Chapter 30 Reports
ZyWALL 5/35/70 Series User’s Guide
541
The following table describes the labels in this screen.
The statistics display as follows when you display the top entries by source.
Table 167 REPORTS > THREAT REPORTS > IDP
LABEL DESCRIPTION
Collect
Statistics Select this check box to have the ZyWALL collect IDP statistics.
The collection starting time displays after you click
Apply . All of the statistics in this
screen are for the time period starting at the time displayed here. The format is year,
month, day and hour, minute, second. All of the statistics are erased if you restart
the ZyWALL or click the
Flush button. Collecting starts over and a new collection
start time displays.
Total Sessions
Scanned This field displays the number of sessions that the ZyWALL has checked for
intrusion characteristics.
Total Sessions
Dropped The ZyWALL can detect and drop malicious sessions from network traffic. This field
displays the number of sessions that the ZyWALL has dropped.
Total Sessions
Reset The ZyWALL can detect and reset suspicious network traffic sessions. This field
displays the number of sessions that the ZyWALL has reset.
Total Packets
Dropped The ZyWALL can detect and drop malicious packets from network traffic. This field
displays the number of packets that the ZyWALL has dropped.
Top Entry By Use this field to have the following (read-only) table display the top IDP entries by
Signature Name , Source or Destination .
Select Signature Name to list the most common signatures that the ZyWALL has
detected.
Select
Source to list the source IP addresses from which the ZyWALL has detected
the most intrusion attempts.
Select
Destination to list the most common destination IP addresses for intrusion
attempts that the ZyWALL has detected.
# This field displays the entry’s rank in the list of the top entries.
Signature Name This column displays when you display the entries by Signature Name . The
signature name identifies a specific intrusion pattern. Click the hyperlink for more
detailed information on the intrusion.
Type This column displays when you display the entries by Signature Name . It shows the
categories of intrusions. See Table 78 on page 282 for more information.
Severity This column displays when you display the entries by Signature Name . It shows the
level of threat that the intrusions may pose. See Table 79 on page 283 for more
information.
Source IP This column displays when you display the entries by Source. It shows the source
IP address of the intrusion attempts.
Destination IP This column displays when you display the entries by Destination. It shows the
destination IP address at which intrusion attempts were targeted.
Occurrences This field displays how many times the ZyWALL has detected the event described in
the entry.
Total This field displays the sum of the occurrences of the events in the entries.
Refresh Click Refresh to update the report display with additional information that the
ZyWALL may have collected while you had the screen open. The report also
refreshes automatically when you close and reopen the screen.
Flush Click Flush to discard the report data and restart collecting statistics.