Saturation Parameters - Symantec 10521146 - Network Security 7120 Administration Manual

Detecting 165
Configuring sensor detection
UDP Flood Alert Threshold
UDP Flood Alert Threshold regulates the level at which the sensor notifies you of
a UDP flood. If the sensor detects a greater percentage of unacknowledged UDP
connections than the Threshold, it triggers a flood event.
The default is set to 0.50 (50%) for a high level of sensitivity. Valid values range
from 0 to 1. Increase the value to make the sensor less sensitive; decrease the
value to make it more sensitive. A value of 1% is extremely sensitive, which
impacts system performance somewhat if it generates alerts. It interacts with
Streak Interval and UDP Number of Streak Packets, and affects performance
slightly if changed.
Note: In versions prior to 4.0, this parameter controlled input and detected both
portscans and floods. Now this parameter controls output and detects either
port scans or floods separately.
Slow Scan Alert Threshold
Slow Scan Alert Threshold regulates the level at which the sensor notifies you of
sweep or scan activity. The sensor detects attempts to connect to the same port
across multiple hosts, which can indicate sweep activity. The sensor also detects
attempts to connect to the same host on multiple ports, which can indicate scan
activity. If the number of attempts breaches the Threshold, it triggers a slow
scan event.
The default is set to 7, and valid values range from 3 to 15, inclusive. If your
network traffic commonly includes many dropped or unacknowledged
connections, you can increase the value to adjust the sensor's tolerance for this
activity. You can decrease the value to make the sensor more sensitive to this
activity, at the cost of affecting performance slightly.

Saturation parameters

The following parameters regulate the percentage of a variety of types of traffic
that the sensor tolerates before it notifies you.
Symantec Network Security provides counter-based detection of floods and
denial-of-service attacks such as resource reservation and pipe filling. For
example, in a reservation attack such as SYNflood, the attacker sends more SYN
packets than the queue can hold, and thus reserves otherwise available
resources and prevents new connections. In a pipe-filling attack, the attacker
saturates the links by generating so much traffic on a network connection that it
clogs a traffic pipe.