Nortel BSR222 Configuration page 195

Table 43 Attack alert
Label
One Minute High
Maximum
Incomplete Low
Maximum
Incomplete High
TCP Maximum
Incomplete
Blocking Period
(min)
Apply
Reset
Description
This is the rate of new half-open sessions that causes the firewall
to start deleting half-open sessions. When the rate of new
connection attempts rises above this number, the Business Secure
Router deletes half-open sessions, as required, to accommodate
new connection attempts.
The numbers, for example, 80 in the One Minute Low field and
100 in this field, cause the Business Secure Router to start deleting
half-open sessions when more than 100 session establishment
attempts are detected in the last minute, and to stop deleting
half-open sessions when fewer than 80 session establishment
attempts are detected in the last minute.
This is the number of existing half-open sessions that causes the
firewall to stop deleting half-open sessions. The Business Secure
Router continues to delete half-open requests, as necessary, until
the number of existing half-open sessions drops below this
number.
This is the number of existing half-open sessions that causes the
firewall to start deleting half-open sessions. When the number of
existing half-open sessions rises above this number, the Business
Secure Router deletes half-open sessions, as required, to
accommodate new connection requests. Do not set Maximum
Incomplete High to lower than the current Maximum Incomplete
Low number.
The above values, say 80 in the Maximum Incomplete Low field
and 100 in this field, cause the Business Secure Router to start
deleting half-open sessions when the number of existing half-open
sessions rises above 100, and to stop deleting half-open sessions
with the number of existing half-open sessions drops below 80.
This is the number of existing half-open TCP sessions with the
same destination host IP address that causes the firewall to start
dropping half-open sessions to that same destination host IP
address. Enter a number between 1 and 256. As a general rule,
choose a smaller number for a smaller network, a slower system or
limited bandwidth.
When TCP Maximum Incomplete is reached you can choose to
either allow or block the next session. If you select the Blocking
Period check box, any new sessions are blocked for the length of
time you specify in the next field (min) and all old incomplete
sessions are cleared during this period. If you want strong security,
it is better to block the traffic for a short time, as it gives the server
some time to digest the loading.
Enter the length of Blocking Period in minutes.
Click Apply to save your changes to the Business Secure Router.
Click Reset to begin configuring this screen afresh.
Nortel Business Secure Router 222 Configuration — Basics
Chapter 11 Firewall screens 195