Web Management Guide-R03

Chapter 12 | Security Measures
DoS Protection
– 337 –
of attack is especially effective since the packets seem to come from different
sources and thus making the perpetrators hard to trace.
These packets may have any of the following attributes:
◆ Source IP address is ::1
◆ Source IP address is 0xFF00::/8
◆ Invalid Destination IP Address – Protects against invalid IPv6 destination
address attacks. When a stream such packets are received, this can indicate a
denial-of-service (DoS) attempt or just a packet generator using RAW sockets
on the network.
Protection for TCP
◆ Invalid Header Length – Protects against attacks which send TCP packets with
an incorrect header length. Such packets are not allowed by the system, but
their abundant number can cause computer crashes and other system errors.
In these packets, the TCP raw header size is less than the minimum size defined
for a TCP header (i.e., the data offset < 5).
◆ Blat Block – Protects against attacks in which a specially crafted packet is sent
to a host where the source host port is the same as the destination host port.
The system attempts to reply to itself, resulting in system lockup.
◆ SYN/URG Block – Protects against attacks in which a TCP SYN/URG message is
used to interrupt or abort the queued stream.
In these packets, SYN=1 and URG=1.
◆ SYN/PSH Block – Protects against attacks in which a TCP SYN/PSH message is
used to force the TCP stack to send this data immediately up to the receiving
application.
In these packets, SYN=1 and PSH=1
◆ SYN/ACK/PSH Block – Protects against attacks in which a TCP SYN/ACK/PSH
message sequence is used to cause problems for some operating systems
which do not acknowledge this as a valid sequence.
In these packets, SYN=1, ACK=1 and PSH=1.
◆ Xmas Scan – Protects against Xmas-scan in which a so-called TCP Xmas scan
message is used to identify listening TCP ports. This scan uses a series of
strangely configured TCP packets which contain a sequence number of 0 and
the URG, PSH and FIN flags. If the target’s TCP port is closed, the target replies
with a TCP RST packet. If the target TCP port is open, it simply discards the TCP
Xmas scan.
In these packets, FIN=1, URG= 1 and PSH = 1.
◆ NULL Scan – Protects against null-scan attacks in which a TCP NULL scan
message is used to identify listening TCP ports. The scan uses a series of
strangely configured TCP packets which contain a sequence number of 0 and