Table 194 Ipsec Logs - ZyXEL Communications P-662H-61 User Manual

Appendix L Log Descriptions
Table 193 Attack Logs (continued)
LOG MESSAGE
ip spoofing - WAN [TCP |
UDP | IGMP | ESP | GRE |
OSPF]
ip spoofing - WAN ICMP
(type:%d, code:%d)
icmp echo: ICMP (type:%d,
code:%d)
syn flood TCP
ports scan TCP
teardrop TCP
teardrop UDP
teardrop ICMP (type:%d,
code:%d)
illegal command TCP
NetBIOS TCP
ip spoofing - no routing
entry [TCP | UDP | IGMP |
ESP | GRE | OSPF]
ip spoofing - no routing
entry ICMP (type:%d,
code:%d)
vulnerability ICMP
(type:%d, code:%d)
traceroute ICMP (type:%d,
code:%d)

Table 194 IPSec Logs

LOG MESSAGE
Discard REPLAY packet
Inbound packet
authentication failed
Receive IPSec packet,
but no corresponding
tunnel exists
Rule <%d> idle time
out, disconnect
WAN IP changed to <IP>
464
DESCRIPTION
The firewall detected an IP spoofing attack on the WAN port.
The firewall detected an ICMP IP spoofing attack on the WAN
port. For type and code details, see
The firewall detected an ICMP echo attack. For type and code
details, see Table 200 on page
The firewall detected a TCP syn flood attack.
The firewall detected a TCP port scan attack.
The firewall detected a TCP teardrop attack.
The firewall detected an UDP teardrop attack.
The firewall detected an ICMP teardrop attack. For type and code
details, see Table 200 on page
The firewall detected a TCP illegal command attack.
The firewall detected a TCP NetBIOS attack.
The firewall classified a packet with no source routing entry as an
IP spoofing attack.
The firewall classified an ICMP packet with no source routing
entry as an IP spoofing attack.
The firewall detected an ICMP vulnerability attack. For type and
code details, see Table 200 on page
The firewall detected an ICMP traceroute attack. For type and
code details, see Table 200 on page
DESCRIPTION
The router received and discarded a packet with an incorrect
sequence number.
The router received a packet that has been altered. A third party
may have altered or tampered with the packet.
The router dropped an inbound packet for which SPI could not find a
corresponding phase 2 SA.
The router dropped a connection that had outbound traffic and no
inbound traffic for a certain time period. You can use the "ipsec timer
chk_conn" CI command to set the time period. The default value is 2
minutes.
The router dropped all connections with the "MyIP" configured as
"0.0.0.0" when the WAN IP address changed.
Table 200 on page
470.
470.
470.
470.
P-662H/HW-D Series User's Guide
470.