Extreme Networks Altitude 4000 Series, Справочное руководство, Страница: 297 / 521

Wireless Firewall
Altitude
TM
4000 Series Access Point System Reference Guide
297
concerted effort of one or more persons attempting to prevent a device, site or service from
functioning temporarily or indefinitely.
Most DoS attacks involve saturating the target device with external communications requests so it
cannot respond to legitimate traffic or respond so slowly the device becomes unavailable in respect
to its defined data rate. DoS attacks are implemented by either forcing targeted devices to reset or
consuming the devices resources so it can no longer provide service.
2 Select the Activate Firewall Policy option on the upper left-hand side of the screen to enable the
screen’s parameters for configuration. Ensure this option stays selected to apply the configuration to
the access point profile
3 The Settings window contains a list of all of the DoS attacks the Firewall has filters for. Each DoS
filter contains the following four items:
4 The following Events can be filtered on behalf of the Firewall:
Event
Lists the name of each DoS attack.
Enable
Select Enable to set the Firewall to filter the associated DoS attack
based on the selection in the Action column.
Action
If a DoS filter is enabled, chose an action from the drop-down menu to
determine how the Firewall treats the associated DoS attack. Options
include:
Log and Drop - An entry for the associated DoS attack is added to the
log and then the packets are dropped.
Log Only - An entry for the associated DoS attack is added to the log.
No further action is taken.
Drop Only - The DoS packets is dropped. No further action is taken.
Log Level
Select this option to enable logging to the system log. Then select a
standard Syslog level from the
Log Level drop-down menu.
Ascend
Ascend DoS attacks are a series of attacks that target known
vulnerabilities in various versions of Ascend routers.
Broadcast/Multicast
ICMP
Broadcast or Multicast ICMP DoS attacks are a series of attacks that
take advantage of ICMP behavior in response to echo replies. These
usually involve spoofing the source address of the target and sending
ICMP broadcast or multicast echo requests to the rest of the network
and in the process flooding the target machine with replies.
Chargen
The Chargen attack establishes a Telnet connection to port 19 and
attempts to use the character generator service to create a string of
characters which is then directed to the DNS service on port 53 to
disrupt DNS services.
Fraggle
The Fraggle DoS attack uses a list of broadcast addresses to send
spoofed UDP packets to each broadcast address’ echo port (port 7).
Each of those addresses that have port 7 open will respond to the
request generating a lot of traffic on the network. For those that do not
have port 7 open they will send an unreachable message back to the
originator, further clogging the network with more traffic.
FTP Bounce
The FTP Bounce DoS attack uses a vulnerability in the FTP “PORT”
command as a way to scan ports on a target machine by using another
machine in the middle.
Invalid Protocol
Attackers may use vulnerability in the endpoint implementation by
sending invalid protocol fields, or may misuse the misinterpretation of
endpoint software. This can lead to inadvertent leakage of sensitive
network topology information, call hijacking, or a DoS attack.