D-Link NetDefend DFL-210 Cli Reference Manual page 180

3.51.20. TCPSettings
TCPMSSOnLow
TCPMSSMax
TCPMSSVPNMax
TCPMSSOnHigh
TCPMSSLogLevel
TCPMSSAutoClamping
TCPZeroUnusedACK
TCPZeroUnusedURG
TCPOPT_WSOPT
TCPOPT_SACK
TCPOPT_TSOPT
TCPOPT_ALTCHKREQ
TCP-
OPT_ALTCHKDATA
TCPOPT_CC
TCPOPT_OTHER
TCPSynUrg
TCPSynPsh
TCPSynRst
TCPSynFin
TCPFinUrg
TCPUrg
TCPECN
How to handle too low MSS values. (Default: DropLog)
Maximum allowed TCP MSS (Maximum Segment Size). (Default:
1460)
Limits TCP MSS for VPN connections; minimizes fragmentation.
(Default: 1400)
How to handle too high MSS values. (Default: Adjust)
When to log regarding too high TCP MSS, if not logged by "TCP
MSS on high". (Default: 7000)
Automatically clamp TCP MSS according to MTU of involved inter-
faces - in addition to "TCP MSS max". (Default: Yes)
Force unused ACK fields to zero; helps prevent connection spoofing.
(Default: Yes)
Force unused URG fields to zero; prevents small information leak.
(Default: Yes)
The WSOPT (Window Scale) option (common). (Default: Validate-
LogBad)
The SACK/SACKPERMIT (Selective ACK) options (common).
(Default: ValidateLogBad)
The TSOPT (Timestamp) option (common). (Default: ValidateLog-
Bad)
The ALTCHKREQ (Alternate Checksum Request) option. (Default:
StripLog)
The ALTCHKDATA (Alternate Checksum Data) option. (Default:
StripLog)
The CC (Connection Count) option series (semi common). (Default:
StripLogBad)
How to handle TCP options not specified above. (Default: StripLog)
The TCP URG flag together with SYN; normally invalid (strip=strip
URG). (Default: DropLog)
The TCP PSH flag together with SYN; normally invalid but always
used by some IP stacks (strip=strip PSH). (Default: StripSilent)
The TCP RST flag together with SYN; normally invalid (strip=strip
RST). (Default: DropLog)
The TCP FIN flag together with SYN; normally invalid (strip=strip
FIN). (Default: DropLog)
The TCP URG flag together with FIN; normally invalid (strip=strip
URG). (Default: DropLog)
The TCP URG flag; many operating systems cannot handle this cor-
rectly. (Default: StripLog)
The Explicit Congestion Notification (ECN) flags. Previously known
as "XMAS"/"YMAS" flags. Also used in OS fingerprinting. (Default:
StripLog)
180
Chapter 3. Configuration Reference