TeleWell TW-EA510v3(c) 3G/4G, Руководство пользователя

Страница: 65 / 101

64
5.3.4.3 Intrusion Detection
Check Enable if you wish to detect intruders accessing your computer without permission. The
router automatically detects and blocks a DoS (Denial of Service) attack if a user enables this
function. This kind of attack is not to access confidential data on the network; instead, it aims to
disrupt specific equipment or the entire network. If this happens, users will have trouble accessing
the network resources.
Intrusion Detection: Check Enable if you wish to detect intruders accessing your computer
without permission.
Maximum TCP Open Handshaking Count: This is a threshold value to decide whether a SYN
Flood attempt is occurring or not. Default value is 100 TCP SYN per seconds.
Maximum Ping Count: This is a threshold value to decide whether an ICMP Echo Storm is
occurring or not. Default value is 15 ICMP Echo Requests (PING) per second.
Maximum ICMP Count: This is a threshold to decide whether an ICMP flood is occurring or not.
Default value is 100 ICMP packets per seconds except ICMP Echo Requests (PING).
Log: Check Log if you wish to generate logs when the filer rule is applied to the Intrusion
Detection.
For SYN Flood, ICMP Echo Storm and ICMP flood, IDS will just warn the user in the Event Log but it
will not be able to protect against such attacks.
Hacker attack types recognized by the IDS
Intrusion Name Detect Parameter Blacklist
Type of Block
Duration
Drop Packet Show Log
Ascend Kill Ascend Kill data Src IP DoS Yes Yes
WinNuke
TCP
Port 135, 137~139,
Flag: URG
Src IP DoS Yes Yes
Smurf
ICMP type 8
Des IP is broadcast
Dst IP
Victim
Protection
Yes Yes