Draytek Vigor2762 series User Manual page 260

Block TCP flag scan
Block Tear Drop
Block Ping of Death
Block ICMP Fragment
Block Unassigned
Numbers
Warning Messages
250
from the Internet might be dropped.
Check the box to activate the Block TCP flag scan
function. Any TCP packet with anomaly flag setting is
dropped. Those scanning activities include no flag scan,
FIN without ACK scan, SYN FINscan, Xmas scan and full
Xmas scan.
Check the box to activate the Block Tear Drop function.
Many machines may crash when receiving ICMP datagrams
(packets) that exceed the maximum length. To avoid this
type of attack, the Vigor router is designed to be capable
of discarding any fragmented ICMP packets with a length
greater than 1024 octets.
Check the box to activate the Block Ping of Death
function. This attack involves the perpetrator sending
overlapping packets to the target hosts so that those
target hosts will hang once they re-construct the packets.
The Vigor routers will block any packets realizing this
attacking activity.
Check the box to activate the Block ICMP fragment
function. Any ICMP packets with more fragment bit set are
dropped.
Check the box to activate the Block Unknown Protocol
function. Individual IP packet has a protocol field in the
datagram header to indicate the protocol type running
over the upper layer. However, the protocol types greater
than 100 are reserved and undefined at this time.
Therefore, the router should have ability to detect and
reject this kind of packets.
We provide Syslog function for user to retrieve message
from Vigor router. The user, as a Syslog Server, shall
receive the report sending from Vigor router which is a
Syslog Client.
All the warning messages related to DoS Defense will be
sent to user and user can review it through Syslog
daemon. Look for the keyword DoS in the message,
followed by a name to indicate what kind of attacks is
detected.
Vigor2762 Series User's Guide