User guide

SmartDefense Categories
226 Check Point ZoneAlarm User Guide
SynDefender
In a SYN attack, the attacker sends many SYN packets without finishing the three-way
handshake. This causes the attacked host to be unable to accept new connections.
You can protect against this attack by specifying a maximum amount of time for
completing handshakes.
Table 53: SynDefender Fields
In this field… Do this…
Action Specify what action to take when a SYN attack occurs, by selecting one of
the following:
• Block. Block the packet. This is the default.
• None. No action.
A SYN attack is when more than 5 incomplete TCP handshakes are
detected within 10 seconds. A handshake is considered incomplete when it
exceeds the Maximum time for completing the handshake threshold.
Track
Specify whether to issue logs for the events specified by the Log Mode
parameter, by selecting one of the following:
• Log. Issue logs. This is the default.
• None. Do not issue logs.