Mitel 1000 Owner's Manual page 146

Use Blacklist
Use Victim Protection
Victim Protection Block
Duration
DOS Attack Block
Duration
Scan Attack Block
Duration
Scan Detection
Threshold
Scan Detection Period
Port Flood Detection
Threshold
Host Flood Detection
Threshold
Flood Detection Period
Maximum TCP Open
Handshaking Count
Maximum Ping Count
Maximum ICMP Count
Enter the following parameters
Enables or disables blacklisting of an external host if the
firewall has detected an intrusion from that host. Access is
denied to that host for 10 minutes.
Enables or disables the blocking of incoming broadcast Ping
commands for the period specified in Victim Protection Block
duration.
The period for which incoming broadcast Pings are blocked.
The default setting is 600 seconds.
If a Denial of Service attack is detected, traffic from that host
is blocked for the duration specified here. The default setting
is 1800 seconds.
If scan activity from a host attempting to identify open ports
is detected, traffic from that host is blocked for the duration
specified here. The default setting is 86400 seconds (1 day).
If the number of scanning packets counted within the Scan
Detection Period exceeds the value set here, a port scan
attack is detected. The default setting is 5 per second.
The duration that scanning type traffic is counted for. The
default setting is 60 seconds.
This is the maximum number of SYN packets that can be
received by a single port before a flood is detected. The
default setting is 10 per second.
This is the maximum number of SYN packets that can be
received from a host before a flood is detected. The default
setting is 20 per second.
If the number of SYN floods counted within this duration
exceeds either the Port Flood Detection Threshold or the
Host Flood Detection Threshold, traffic from the attacker is
blocked for the DOS Attack Block Duration. The default
setting is 10 seconds.
This is the maximum number (per second) of unfinished
TCP handshaking sessions that are allowed before a DOS
attack is detected. The default setting is 5 per second.
This is the maximum number of Pings (per second) that are
allowed before a DOS attack is detected.
This is the maximum number of ICMP ins (per second) that
are allowed before a DOS attack is detected.
146