What You Need To Know - ZyXEL Communications VMG1312-B Series User Manual

Chapter 15 Firewall

15.1.2 What You Need to Know

SYN Attack
A SYN at t ack floods a t arget ed syst em wit h a series of SYN packet s. Each packet causes t he
t arget ed syst em t o issue a SYN- ACK response. While t he t arget ed syst em wait s for t he ACK t hat
follows t he SYN- ACK, it queues up all out st anding SYN- ACK responses on a backlog queue. SYN-
ACKs are m oved off t he queue only when an ACK com es back or when an int ernal t im er t erm inat es
t he t hree- way handshake. Once t he queue is full, t he syst em will ignore all incom ing SYN request s,
m aking t he syst em unavailable for legit im at e users.
DoS
Denials of Service ( DoS) at t acks are aim ed at devices and net works wit h a connect ion t o t he
I nt ernet . Their goal is not t o st eal inform at ion, but t o disable a device or net work so users no longer
have access t o net work resources. The ZyXEL Device is pre- configured t o aut om at ically det ect and
t hwart all known DoS at t acks.
DDoS
A DDoS at t ack is one in which m ult iple com prom ised syst em s at t ack a single t arget , t hereby
causing denial of service for users of t he t arget ed syst em .
LAND Attack
I n a LAND at t ack, hackers flood SYN packet s int o t he net work wit h a spoofed source I P address of
t he t arget syst em . This m akes it appear as if t he host com put er sent t he packet s t o it self, m aking
t he syst em unavailable while t he t arget syst em t ries t o respond t o it self.
Ping of Death
Ping of Deat h uses a " ping" ut ilit y t o creat e and send an I P packet t hat exceeds t he m axim um
65,536 byt es of dat a allowed by t he I P specificat ion. This m ay cause syst em s t o crash, hang or
reboot .
SPI
St at eful Packet I nspect ion ( SPI ) t racks each connect ion crossing t he firewall and m akes sure it is
valid. Filt ering decisions are based not only on rules but also cont ext . For exam ple, t raffic from t he
WAN m ay only be allowed t o cross t he firewall in response t o a request from t he LAN.
218
VMG1312-B Series User's Guide