ZyXEL Communications ZyWall 10 User Manual page 181

LABEL
One Minute High
Maximum
Incomplete Low
Maximum
Incomplete High
TCP Maximum
Incomplete
Firewall Screens
Table 12-6 Attack Alert
DESCRIPTION
This is the rate of new half-open sessions that
causes the firewall to start deleting half-open
sessions. When the rate of new connection
attempts rises above this number, the ZyWALL
deletes half-open sessions as required to
accommodate new connection attempts.
This is the number of existing half-open
sessions that causes the firewall to stop
deleting half-open sessions. The ZyWALL
continues to delete half-open requests as
necessary, until the number of existing half-
open sessions drops below this number.
This is the number of existing half-open
sessions that causes the firewall to start
deleting half-open sessions. When the number
of existing half-open sessions rises above this
number, the ZyWALL deletes half-open
sessions as required to accommodate new
connection requests. Do not set Maximum
Incomplete High to lower than the current
Maximum Incomplete Low number.
This is the number of existing half-open TCP
sessions with the same destination host IP
address that causes the firewall to start
dropping half-open sessions to that same
destination host IP address. Enter a number
between 1 and 256. As a general rule, you
should choose a smaller number for a smaller
network, a slower system or limited bandwidth.
ZyWALL 10~100 Series Internet Security Gateway
deleting half-open sessions when
been detected in the last minute,
session establishment attempts
have been detected in the last
80 existing half-open sessions.
100 existing half-open sessions.
open sessions when the number
deleting half-open sessions with
the number of existing half-open
DEFAULT VALUES
100 half-open sessions per
minute. The above numbers
cause the ZyWALL to start
more than 100 session
establishment attempts have
and to stop deleting half-open
sessions when fewer than 80
minute.
The above values causes the
ZyWALL to start deleting half-
of existing half-open sessions
rises above 100, and to stop
sessions drops below 80.
10 existing half-open TCP
sessions.
12-23