D-Link DFL-M510, Руководство пользователя

Страница: 111 / 153

102
HEALTH CHECKING
The Health Checking table is a layer seven table. Instead of classifying the application
pattern, several packets that come from attacking tools can damage the host. Some of
the packets are assembled and stored in the file system and are detectable by
anti-virus software. Some packets try to get system authorized control and run as an
operating system’s administrator without storing to the file system. These packets are
invisible to almost all anti-virus software, but detectable by the DFL-M510. When
those packets come from a host and are detected, the corresponding field shows a
check mark to indicate the host has health concern problems.
Health-concern problems include network based worms, illegal agents, and tunnels.
Network based worms do not include common viruses, since they are easy to discover
by standard virus software.
Illegal agents include backdoors, trojans, spyware, and ad-ware.
Tunnels are host-based software. They provide a secure channel for communication.
The purpose is to break through a firewall and escape content inspecting. For example,
like soft ether, VNN, and VNC.