User guide

SmartDefense Categories
Chapter 11: Using SmartDefense 239
Table 61: Worm Catcher Fields
In this field… Do this…
Action Specify what action to take when an HTTP-based worm attack is
detected, by selecting one of the following:
• Block. Block the attack.
• None. No action. This is the default.
Track Specify whether to log HTTP-based worm attacks, by selecting one of
the following:
• Log. Log the attack.
• None. Do not log the attack. This is the default.
HTTP-based worm
patterns list
Select the worm patterns to detect.
Peer-to-Peer
SmartDefense can block peer-to-peer file-sharing traffic, by identifying the proprietary
protocols and preventing the initial connection to the peer-to-peer networks. This prevents
not only downloads, but also search operations.
This category includes the following nodes:
• BitTorrent
• eMule
• Gnutella
• KaZaA
• Winny
Note: SmartDefense can detect peer-to-peer traffic regardless of the TCP port being
used to initiate the session.