Attack Checks - D-Link DSR-150 User Manual

Section 8 - Security
Path: Security > Firewall > Attack Checks
Attacks can be malicious security breaches or unintentional network issues that render the router unusable
Attack checks allow you to manage WAN security threats such as continual ping requests and discovery via ARP
scans. TCP and UDP flood attack checks can be enabled to manage extreme usage of WAN resources.
Additionally certain Denial-of-Service (DoS) attacks can be blocked. These attacks, if uninhibited, can use up
processing power and bandwidth and prevent regular network services from running normally. ICMP packet
flooding, SYN traffic flooding, and Echo storm thresholds can be configured to temporarily suspect traffic from
the offending source.
1. Click Security > Firewall > Attack Checks.
2. Complete the fields from the table below and click Save.
Field
Stealth Mode
Block TCP Flood
Filter Check
Block UDP Flood
Block ICMP Notification
Block Fragmented Packets
D-Link DSR-Series User Manual

Attack Checks

If this option is toggled to ON, the router will not respond to port scans from the WAN. This makes it
less susceptible to discovery and attacks.
If this option is toggled to ON, the router will drop all invalid TCP packets and be protected from a
SYN flood attack.
If this option is enabled, then router will drop invalid TCP packets(FIN,RST and ACK) going with
SNAT while the connection is closed. Some of the other packets like TCP OUT-OF-WINDOW are also
considered to be invalid. Disable this option while taking performance in Ixia setup as enabling this
option will effect the throughput.
If this option is toggled to ON, the router will not accept more than the configured value in 'UDP
Connection Limit' which indicates simultaneous, active UDP connections from a single computer
on the LAN. You can set the number of simultaneous active UDP connections to be accepted from a
single computer on the LAN; the default is 25 and the range is 25 to 500.
Toggle to ON to prevent ICMP packets from being identified as such. ICMP packets, if identified, can
be captured and used in a Ping (ICMP) flood DoS attack.
Toggle to ON to drop any fragmented packets through or to the gateway
Description
199