Advertisement
Intrusion Name
Ascend Kill
WinNuke
Smurf
Land attack
Echo/CharGen Scan
Echo Scan
CharGen Scan
X'mas Tree Scan
IMAP
SYN/FIN Scan
SYN/FIN/RST/ACK
Scan
Net Bus Scan
Back Orifice Scan
SYN Flood
ICMP Flood
ICMP Echo
Src IP: Source IP
Dst Port: Destination Port
Chapter 4: Configuration
Table 2: Hacker attack types recognized by the IDS
Detect Parameter
Ascend Kill data
TCP
Port 135, 137~139,
Flag: URG
ICMP type 8
Des IP is broadcast
SrcIP = DstIP
UDP Echo Port and
CharGen Port
UDP Dst Port =
Echo(7)
UDP Dst Port =
CharGen(19)
TCP Flag: X'mas
TCP Flag: SYN/FIN
DstPort: IMAP(143)
SrcPort: 0 or 65535
TCP,
No Existing session
And
Scan
Hosts
more than five.
TCP
No Existing session
DstPort = Net Bus
12345,12346, 3456
UDP,
DstPort
=
Orifice Port (31337)
Max
TCP
Open
Handshaking Count
(Default 100 c/sec)
Max ICMP Count
(Default 100 c/sec)
Max PING Count
(Default 15 c/sec)
Src Port: Source Port
Dst IP: Destination IP
VoIP/(802.11g) ADSL2+ (VPN) Firewall Router
Type of Block
Blacklist
Duration
Src IP
DoS
Src IP
DoS
Victim
Dst IP
Protection
Src IP
Scan
Src IP
Scan
Src IP
Scan
Src IP
Scan
Src IP
Scan
SrcIP
Scan
SrcIP
Scan
Drop Packet Show Log
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
69
Advertisement
