Intrusion Detection
The router Intrusion Detection System (IDS) is used to detect hacker’s attack and intrusion
attempts from the Internet. If the IDS function of the firewall is enabled, inbound packets are
filtered and blocked depending on whether they are detected as possible hacker attacks, intrusion
attempts or other connections that the router determines to be suspicious.
Blacklist:
If the router detects a possible attack, the source IP or destination IP address will be
added to the Blacklist. Any further attempts using this IP address will be blocked for the time
period specified as
Block Duration
. Default setting for this function is false (disabled). Some
attack types are denied immediately without using the Blacklist function, such as Land attack and
Echo/CharGen scan.
Intrusion Detection:
Check Enable if you wish to detect intruders accessing your computer
without permission.
Block Duration:
•
Victim Protection Block Duration:
This is the duration for blocking Smurf attacks. Default
value is 600 seconds.
•
Scan Attack Block Duration:
This is the duration for blocking hosts that attempt a possible
Scan attack. Scan attack types include X’mas scan, IMAP SYN/FIN scan and similar attempts.
Default value is 86400 seconds.
•
DOS Attack Block Duration:
This is the duration for blocking hosts that attempt a possible
Denial of Service (DoS) attack. Possible DoS attacks this attempts to block include Ascend Kill
and WinNuke. Default value is 1800 seconds.
Maximum TCP Open Handshaking Count:
This is a threshold value to decide whether a SYN
Flood attempt is occurring or not. Default value is 100 TCP SYN per seconds.
Maximum Ping Count:
This is a threshold value to decide whether an ICMP Echo Storm is
occurring or not. Default value is 15 ICMP Echo Requests (PING) per second.
Maximum ICMP Count:
This is a threshold to decide whether an ICMP flood is occurring or not.
Default value is 100 ICMP packets per seconds except ICMP Echo Requests (PING).
For SYN Flood, ICMP Echo Storm and ICMP flood, IDS will just warn the user in the Event Log. It
cannot protect against such attacks.
Click Apply to confirm the settings.
98
Содержание BiPAC 8500
Страница 4: ...Chapter 5 Troubleshooting 172 Appendix Product Support Contact 173...
Страница 33: ...Status 8500 29...
Страница 34: ...8520 30...
Страница 35: ...8501 31...
Страница 36: ...8501 R2 32...
Страница 37: ...8521 33...
Страница 86: ...EFMBond 4 wired Connection 82...
Страница 104: ...Src IP Source IP Src Port Source Port Dst Port Destination Port Dst IP Destination IP 100...
Страница 126: ...Example Configuring a IPSec Host to LAN VPN Connection 122...
Страница 161: ...ifMIBObjects Group From RFC1695 atmMIB atmMIBObjects From RFC 1907 SNMPv2 only snmpSetSerialNo OID 157...
