Nokia IP60 - Security Appliance, Руководство пользователя

Страница: 294 / 494

SmartDefense Categories
294 Nokia IP60 Security Appliance User Guide
Flags
The URG flag is used to indicate that there is urgent data in the TCP stream, and that the data should be
delivered with high priority. Since handling of the URG flag is inconsistent between different operating
systems, an attacker can use the URG flag to conceal certain attacks.
You can configure how the URG flag should be handled.
Table 73: Flags Fields
In this field… Do this…
URG Flag Specify whether to clear or allow the URG flag, by selecting one of the
following:
Clear.
Clear the URG flag on all incoming packets. This is the
default.
Allow.
Allow the URG flag.
Port Scan
An attacker can perform a port scan to determine whether ports are open and vulnerable to an attack. This is
most commonly done by attempting to access a port and waiting for a response. The response indicates
whether or not the port is open.
This category includes the following types of port scans:
Host Port Scan.
The attacker scans a specific host's ports to determine which of the ports are
open.
Sweep Scan.
The attacker scans various hosts to determine where a specific port is open.
You can configure how the IP60 appliance should react when a port scan is detected.