ADTRAN AOS Version R10.1.0 Command Reference Manual page 1002

Command Reference Guide
The table (on the following pages) outlines the types of IPv4 traffic discarded by the firewall attack
protection engine. Many attacks use similar invalid traffic patterns; therefore, attacks other than the
examples listed below may also be blocked by the firewall. To determine if a specific attack is blocked by
the AOS firewall, please contact ADTRAN technical support.
Invalid IPv4 Traffic Pattern
Larger than allowed packets
Fragmented IP packets that
produce errors when
attempting to reassemble
Smurf Attack
IP Spoofing
ICMP Control Message
Floods and Attacks
Attacks that send TCP URG
packets
Falsified IP Header Attacks
Echo
60000CRG0-35E
Manually AOS Firewall Response
Enabled?
No Any packets that are longer than those
defined by standards will be dropped.
No The firewall intercepts all fragments for an
IP packet and attempts to reassemble
them before forwarding to destination. If
any problems or errors are found during
reassembly, the fragments are dropped.
No The firewall will drop any ping responses
that are not part of an active session.
No The firewall will drop any packets with a
source IP address that appears to be
spoofed. The IP route table is used to
determine if a path to the source address
is known (out of the interface from which
the packet was received). For example, if
a packet with a source IP address of
10.10.10.1 is received on interface fr 1.16
and no route to 10.10.10.1 (through
interface fr 1.16) exists in the route table,
the packet is dropped.
No The following types of ICMP packets are
allowed through the firewall: echo,
echo-reply, TTL expired, dest.
Unreachable, and quench. These ICMP
messages are only allowed if they appear
to be in response to a valid session. All
others are discarded.
Yes Any TCP packets that have the URG flag
set are discarded by the firewall.
No The firewall verifies that the packet's
actual length matches the length indicated
in the IP header. If it does not, the packet
is dropped.
No All UDP echo packets are discarded by the
firewall.
Copyright © 2012 ADTRAN, Inc.
Global Configuration Mode Command Set
Common
Attacks
Ping of Death
SynDrop,
TearDrop,
OpenTear,
Nestea, Targa,
Newtear,
Bonk, Boink
Smurf Attack
IP Spoofing
Twinge
Winnuke, TCP
XMAS Scan
Jolt/Jolt2
Char Gen
1002