Attack Alert; Threshold Values; Figure 15-5 E-Mail Log - ZyXEL Communications ZyXEL ZYWALL10 User Manual

Subject:
Firewall Alert From ZyWALL
Date:
Fri, 07 Apr 2000 10:05:42
From:
user@zyxel.com
To:
user@zyxel.com
1|Apr 7 00 |From:192.168.1.1
|forward
| 09:54:03 |UDP
2|Apr 7 00 |From:192.168.1.131
|forward
| 09:54:17 |UDP
3|Apr 7 00 |From:192.168.1.6
| 09:54:19 |UDP
...................................{snip}.........................................
...................................{snip}.........................................
126|Apr 7 00 |From:192.168.1.1
|forward
| 10:05:00 |UDP
127|Apr 7 00 |From:192.168.1.131
|forward
| 10:05:17 |UDP
128|Apr 7 00 |From:192.168.1.1
|forward
| 10:05:30 |UDP
End of Firewall Log

15.4 Attack Alert

The first defense against DOS attacks. In this screen you may choose to generate an alert whenever an attack
is detected. For DoS attacks, the ZyWALL uses thresholds to determine when to drop sessions that do not
become fully established. These thresholds apply globally to all sessions.
You can use the default threshold values, or you can change them to values more suitable to your security
requirements.

15.4.1 Threshold Values:

Tune these parameters when something is not working and after you have checked the firewall counters.
These default values should work fine for normal small offices with ADSL bandwidth. Factors influencing
choices for threshold values are:
1. The maximum number of opened sessions.
2. The minimum capacity of server backlog in your LAN network.
3. The CPU power of servers in your LAN network.
4. Network bandwidth.
Introducing the ZyWALL Web Configurator
To:192.168.1.255
src port:00520 dest port:00520
To:192.168.1.255
src port:00520 dest port:00520
To:10.10.10.10 |match
src port:03516 dest port:00053
To:192.168.1.255
src port:00520 dest port:00520
To:192.168.1.255
src port:00520 dest port:00520
To:192.168.1.255
src port:00520 dest port:00520

Figure 15-5 E-mail Log

ZyWALL 10 Internet Security Gateway
The date format
here is
Day-Month-Year.
|default permit
|<1,00>
|default permit
|<1,00>
|forward
|<1,01>
|match
|<1,02>
|match
|<1,02>
|match
|<1,02>
You may edit the
subject title
The date format
|
here is Month-Day-
Year. The time
format is Hour-
|
Minute-Second.
|
|
"End of Log"
message shows that
|
a complete log has
been sent.
|
15-7