Using SmartDefense
Table 48: Port Scan Fields
In this field… Do this…
Number of ports
accessed
SmartDefense detects ports scans by measuring the number of ports
accessed over a period of time. The number of ports accessed must exceed
the
Number of ports accessed
value, within the number of seconds specified by
the
In a period of [seconds]
value, in order for SmartDefense to consider the
activity a scan.
Type the minimum number of ports that must be accessed within the
In a
period of [seconds]
period, in order for SmartDefense to detect the activity as
a port scan.
For example, if this value is 30, and 40 ports are accessed within a specified
martDefense will detect the activity as a port scan.
value is 30. For Sweep Scan, the default
period of time, S
For Host Port Scan, the default
value is 50.
Chapter 9: Setting Your Security Policy
243