Draytek Vigor2762 series, Руководство пользователя

Страница: 243 / 651

Stateful Packet
Stateful Packet
Inspection (
Inspection (
SPI)
SPI)
Stateful inspection is a firewall architecture that works at the network layer. Unlike legacy
static packet filtering, which examines a packet based on the information in its header,
stateful inspection builds up a state machine to track each connection traversing all
interfaces of the firewall and makes sure they are valid. The stateful firewall of Vigor router
not only examines the header information also monitors the state of the connection.
Denial of
Denial of
Service (
Service (
DoS) Defense
DoS) Defense
The DoS Defense functionality helps you to detect and mitigate the DoS attack. The attacks
are usually categorized into two types, the flooding-type attacks and the vulnerability
attacks. The flooding-type attacks will attempt to exhaust all your system's resource while
the vulnerability attacks will try to paralyze the system by offending the vulnerabilities of
the protocol or operation system.
The DoS Defense function enables the Vigor router to inspect every incoming packet based
on the attack signature database. Any malicious packet that might duplicate itself to
paralyze the host in the secure LAN will be strictly blocked and a Syslog message will be
sent as warning, if you set up Syslog server.
Also the Vigor router monitors the traffic. Any abnormal traffic flow violating the pre-
defined parameter, such as the number of thresholds, is identified as an attack and the
Vigor router will activate its defense mechanism to mitigate in a real-time manner.
The below shows the attack types that DoS/DDoS defense function can detect:
1. SYN flood attack
2. UDP flood attack
3. ICMP flood attack
4. Port Scan attack
5. IP options
6. Land attack
7. Smurf attack
8. Trace route
9. SYN fragment
10. Fraggle attack
11. TCP flag scan
12. Tear drop attack
13. Ping of Death attack
14. ICMP fragment
15. Unassigned Numbers
Vigor2762 Series User’s Guide 233