Intrusion Detection System (Ids) - Patton electronics IPLink 2603 Getting Started Manual

Models 2603, 2621, and 2635 Getting Started Guide

Intrusion Detection System (IDS)

The security feature in the IPLink Router provides protection from a number of attacks. Some attacks cause a
host to be blacklisted (i.e., no traffic from that host is accepted under any circumstances) for a period of time.
Other attacks are simply logged. The subsequent table is a summary of the attacks detected.
Ascend Kill
Echo/Chargen
Echo Scan
WinNuke
Xmas Tree Scan
IMAP SYN/FIN Scan TCP
Smurf
SYN/FIN/RST Flood TCP
Net Bus Scan
Back Orifice Scan
1. To enable IDS, click on Enabled for "Intrusion Detection Enabled" on the "Security Interface Configura-
tion" page. Then click on Change State.
2. Click on Configure Intrusion Detection...
3. You may choose which of the parameters to configure and for which value.
– Use Blacklist: Default = 10 minutes when enabled.
If IDS has detected an intrusion an external host, access to the network is denied for ten minutes.
– Use Victim Protection: Default = Disabled.
Victim Protection. When enabled, Victim Protection protects the victim from an attempted spoofing attack.
Web spoofing allows an attacker to create a 'shadow' copy of the world wide web (WWW). All access to the
shadow Web goes through the attacker's machine, so the attacker can monitor all of the victim's activities and
send false data to or from the victim's machine. When enabled, packets destined for the victim host of a spook-
ing style attack are blocked.
– Victim Protection Block Duration: Default = 600 seconds
– DOS Attack Block Duration:Default = 1800 seconds (30 minutes).
A Denial of Service (DOS) attack is an attempt by an attacker to prevent legitimate users from using a service.
If a DOS attack is detected, all suspicious hosts are blocked by the firewall for a set time limit
– Scan Attack Block Duration:Default = 86400 seconds
Sets the duration for blocking all suspicious hosts. The firewall detects when the system is being scanned by a
suspicious host attempting to identify any open ports.

Intrusion Detection System (IDS)

Attack Name Protocol
UDP
UDP
UDP
TCP
TCP
ICMP
TCP
UDP
Attacking Host
Blacklisted?
yes
no
yes
yes
yes
yes
If victim protection set
If scanning threshold
exceeded
yes
yes
7 • Security
78