ECS4110-28T_Management Guide

C HAPTER 13 | Security Measures
DoS Protection
– 400 –
target's TCP port is closed, the target replies with a TCP RST (reset)
packet. If the target TCP port is open, it simply discards the TCP SYN
FIN scan. (Default: Enabled)
◆ TCP Xmas Scan – A so-called TCP XMAS scan message is used to
identify listening TCP ports. This scan uses a series of strangely
configured TCP packets which contain a sequence number of 0 and the
URG, PSH and FIN flags. If the target's TCP port is closed, the target
replies with a TCP RST packet. If the target TCP port is open, it simply
discards the TCP XMAS scan. (Default: Enabled)
◆ UDP Flooding Attack – Attacks in which a perpetrator sends a large
number of UDP packets (with or without a spoofed-Source IP) to
random ports on a remote host. The target will determine that
application is listening at that port, and reply with an ICMP Destination
Unreachable packet. It will be forced to send many ICMP packets,
eventually leading it to be unreachable by other clients.
(Default: Disabled)
◆ UDP Flooding Attack Rate – Maximum allowed rate.
(Range: 64-2000 kbits/second; Default: 1000 kbits/second)
◆ WinNuke Attack – Attacks in which affected the Microsoft Windows
3.1x/95/NT operating systems. In this type of attack, the perpetrator
sends the string of OOB out-of-band (OOB) packets contained a TCP
URG flag to the target computer on TCP port 139 (NetBIOS), casing it
to lock up and display a “Blue Screen of Death.” This did not cause any
damage to, or change data on, the computer’s hard disk, but any
unsaved data would be lost. Microsoft made patches to prevent the
WinNuke attack, but the OOB packets. (Default: Disabled)
◆ WinNuke Attack Rate – Maximum allowed rate. (Range: 64-2000
kbits/second; Default: 1000 kbits/second)
WEB INTERFACE
To protect against DoS attacks:
1. Click Security, DoS Protection.
2. Enable protection for specific DoS attacks, and set the maximum
allowed rate as required.
3. Click Apply