Advanced Settings
Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.40 Locally Managed Administration Guide | 144
Streaming
Engine Settings
Attribute
Description
Multiple
parameters
These settings determine how the TCP streaming engine used by the
various deep inspection blades (IPS, Application Control, Anti-Bot, Anti-
Virus, etc.) handles protocol violations and events that prevent the
streaming engine from further inspection.
We highly recommend that these settings always be in prevent mode.
Using these settings in detect mode may significantly lower security as
inspection stops when the event or violation occurs.
When the configuration is set to
log
such events, the logs are shown in
Logs & Monitoring
>
Security Logs
under the IPS blade.
For each violation or event configure the
action
and
tracking
mode.
TCP Segment
Limit Enforcement
For every TCP segment that passes through the gateway, the gateway
retains a copy of the segment until it receives an acknowledgment that
the segment was received. This buffered data occupies space in the
gateway's memory. This enforces a limit on the number and size of
buffered segments per connection. When a connection reaches one of
these limits, the gateway does not accept new segments for this
connection until buffered segments are acknowledged.
TCP Out of
Sequence
The receiving host of a TCP stream buffers segments and retains only
those segments within a specified window. Segments outside this
window are not processed by the receiving host. TCP segments which
are outside the TCP receiving window should not be processed by the
gateway. All data from TCP segments that are outside of the window is
either dropped or removed. If the segment is near the window, data is
stripped. If the segment is far from the window, the segment is dropped.
TCP Invalid
Retransmission
For every TCP segment that passes through the gateway, the gateway
retains a copy of the segment until the gateway receives an
acknowledgment that the segment was received. If no acknowledgment
is received, the source machine sends the segment again, which the
gateway compares to its copy to verify that the new packet matches the
original. Passing a retransmission that differs from the original allows
uninspected data to reach the destination application. This can block
segment retransmissions which differ from the original segments, and
this assures that the gateway inspects all data that is processed by the
receiving application. When set to detect, such retransmissions causes
the traffic to bypass deep inspection blades.
TCP Invalid
Checksum
The gateway does not need to inspect packets with an invalid TCP
checksum because these packets are dropped by the receiving host's
TCP stack. This blocks TCP packets with an invalid checksum. Due to
malfunctioning networking equipment, it is normal to see some packets
with an incorrect checksum on the network. This does not indicate an
attempted attack and for this reason, the default is to NOT log such
events.
Table: Streaming Engine Setting Attributes
