Table of Contents
Advertisement
users. ("SYN" is short for SYN chronize"; this is the first step in opening an Internet
connection). You can select this box if you wish to protect the network from TCP
SYN flooding.
WinNuke: Check or un-check this option to enable or disable protection against
WinNuke attacks. Some older versions of the Microsoft Windows OS are vulnerable
to this attack. If the computers in the LAN are not updated with recent
versions/patches, you are advised to enable this protection by checking this check
box.
MIME Flood: Check or un-check this option to enable or disable protection against
MIME attacks. You can select this box to protect the mail server in your network
against MIME flooding.
FTP Bounce: Check or un-check this option to enable or disable protection against
FTP bounce attack. In its simplest terms, the attack is based on the misuse of the
PORT command in the FTP protocol. An attacker can establish a connection
between the FTP server machine and an arbitrary port on another system. This
connection may be used to bypass access controls that would otherwise apply.
IP Unaligned Time-Stamp: Check or un-check this option to enable or disable
protection against unaligned IP time stamp attack. Certain operating systems will
crash if they receive a frame with the IP timestamp option that isn't aligned on a
32-bit boundary.
Sequence Number Prediction Check: For TCP packets, sequence number is
used to guard against accidental receipt of unintended data and malicious use by
the attackers if the ISN (Initial Sequence Number) is generated randomly. Forged
packets with valid sequence numbers can be used to gain trust form the receiving
host. Attackers can then gain access to the compromised system. Note that this
attack affects only the TCP packets originated or terminated at the Internet Security
Router.
Sequence Number Out of Range Check: Protect against TCP out of range
sequence number attacks. An attacker can send a TCP packet to cause an
Intrusion Detection System (IDS) to become unsynchronized with the data in a
connection. Subsequent frames sent in that connection may then be ignored by the
IDS. This may indicate an unsuccessful attempt to hijack a TCP session.
67
Advertisement
Table of Contents
