Billion Electric Company 6404VP Hacker attack types recognized by the IDS, Intrusion Name, Smurf

Page 56
Table 2: Hacker attack types recognized by the IDS

VoIP/(802.11g) Broadband Firewall Router

Table 2: Hacker attack types recognized by the IDS

Intrusion Name

Detect Parameter

 

 

Ascend Kill

Ascend Kill data

 

 

 

TCP

WinNuke

Port 135, 137~139,

 

Flag: URG

Smurf

ICMP type 8

Des IP is broadcast

 

Land attack

SrcIP = DstIP

Echo/CharGen Scan

UDP Echo Port and

 

CharGen Port

Echo Scan

UDP Dst Port =

Echo(7)

 

CharGen Scan

UDP Dst Port =

CharGen(19)

 

Intrusion NameDetect Parameter Blacklist Ascend KillWinNuke

Src IP

Src IP

Dst IP

Src IP

Src IP

Type of Block

Duration

DoS

DoS

Victim

Protection

Scan

Scan

SmurfLand attack Drop Packet Echo Scan Blacklist

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Show Log

Yes

Yes

Yes

Yes

Yes

Yes

Yes

X’mas Tree Scan

IMAP

SYN/FIN Scan

SYN/FIN/RST/ACK

Scan

Net Bus Scan

Back Orifice Scan

SYN Flood

ICMP Flood

ICMP Echo

TCP Flag: X’mas

TCP Flag: SYN/FIN

DstPort: IMAP(143)

SrcPort: 0 or 65535

TCP,

No Existing session

And Scan Hosts more than five.

TCP

No Existing session DstPort = Net Bus 12345,12346, 3456

UDP, DstPort =

Orifice Port (31337)

Max TCP Open

Handshaking Count

(Default 100 c/sec)

Max ICMP Count (Default 100 c/sec)

Max PING Count (Default 15 c/sec)

Src IP

Src IP

Src IP

SrcIP

SrcIP

Scan

Scan

Scan

Scan

Scan

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Src IP: Source IP

Src Port: Source Port

Dst Port: Destination Port

Dst IP: Destination IP

55

Chapter 4: Configuration

Page 55 Page 57
Image 56
Page 55 Page 57
Contents BiPAC 6404VP / 6404VGP VoIP/802.11g Broadband Firewall RouterUser’s Manual Version Release 5.08aTable of Contents Firewall and Access Control QoS Quality of ServiceCHAPTER 5 TROUBLESHOOTING VoIP Voice over Internet ProtocolFeatures Chapter 1 IntroductionIntroduction to your Router 802.11g Wireless AP with WPA SupportQuality of Service QoS Dynamic Host Configuration Protocol DHCP client and serverNetwork Address Translation NAT SOHO Firewall Security with DoS and SPIFirmware Upgradeable Rich Management InterfacesChapter 2 Installing the Router Important note for using this routerPackage Contents Do not use the same power source for this router as other equipmentThe Front LEDs RJ-45 connectorWireless Router Only RJ-11 connectorThe Rear Ports Port Power Switch PWR RESETWAN LAN Phone 1XCabling Chapter 3 Basic Installation Chapter 3 Basic InstallationConnecting Your Router ATA Mode Broadband Router Mode4. Select Internet Protocol TCP/IP and click Properties. See Figure Configuring PCs in Windows in Window XP2. Double-click Local Area Connection. See Figure 4. Select Internet Protocol TCP/IP and click Properties See Figure Configuring PCs in Windows2. Double-click Local Area “LAN” Connection. See Figure 3. Click Properties Configuring PC in Windows 95/98/ME5. Then select the DNS Configuration tab. See Figure Configuring PC in Windows NT4.0 2. Select TCP/IP Protocol and click Properties. See FigureFactory Default Settings Web Interface Username and PasswordDevice LAN IP settings ISP setting in WAN sitePPPoE Information from your ISPDHCP Obtain an IP Address Automatically Static IP Fixed IP Address Configuring with your Web Browser Chapter 4 Configuration ATA / Router Mode ConfigurationSave Config to FLASH StatusWireless Association Table Wireless Router Only StatusARP Table Routing TableDHCP Table RIP Routing TableLeased Table Expired TableEmail Status VoIP StatusError Log Event LogDiagnostic NAT SessionsUPnP Portmap ATA / Router Mode Functions LAN NAT DHCP Server Device IP WAN System Firewall QoS Virtual ServerTime Schedule Advanced VoIP RouterConfiguration LAN Local Area NetworkEthernet Primary IP AddressIP Alias Ethernet Client Filter → Active PC in LANEthernet Client Filter Default setting is set to Disable Active PC in LAN displays a list of individual Ethernet device’s IP Address & MAC Address which connecting to the router Wireless Wireless Router Only ParametersWireless Distribution System WDS Wireless Security Wireless Router Only WPA-PSK TKIP / WPA-PSK AES Pre-Shared KeyPage →Associated Wireless Clients Wireless Client / MAC Address Filter Wireless Router OnlyWireless Client Filter Default setting is set to Disable DHCP Server System Time ZoneRemote Access Firmware Upgrade Backup / Restore Restart Router User Management Firewall and Access Control General Settings Packet Filter Example Predefined Port Filters Rules Table 1 Predefined Port FilterApplication ProtocolUDP17 Packet Filter - Add TCP/UDP Filter Packet Filter - Add Raw IP Filter Page Click Delete Click Add TCP/UDP FilterExample Configuring Packet Filter5. The new port filter rule for HTTP is shown below Intrusion Detection Block DurationTable 2 Hacker attack types recognized by the IDS Intrusion NameDetect Parameter Ascend KillURL Filter Always Ondropped IM / P2P Blocking Instant Message Blocking The default is set to DisabledPeer to Peer Blocking The default is set to Disabled Firewall Log Log information can be seen in the Status - Event Log after enablingVoIP Voice over Internet Protocol VoIP Broadband Firewall RouterVoice QoS Setting for Phone PortWizard NOTE User defined profiles are limited to 8 only Authentication Username Same as Phone NumberUser-defined Profiles SIP Device Parameters How to register to SIP Server Advanced - ParametersAdvanced - PSTN Environment Adjustment Note ONHOOK means hung upLogin Account Configuration Phone PortFor examples Volume ControlCodec Preference Speed DialPSTN Dial Plan PSTN Dial Plan Examples 3 Dial at Timeout4 Dial at Timeout no Prefix 1 Dial with PrefixChapter 4 Configuration VoIP Dial Plan Dial Plan Rules List Prefix ProcessingDial-Plan Examples DescriptionSpecial Dial Plan Examples ## xxLocalcheap.com is the default VoIP provider I set on phone port 1. When I call out any number start with 1 or 2 or 3 and plus rest of the phone number for local call, 03 is always prepended in front of these number. If 23295 are dialed, 03-2-32935 is the actual phone number called out via localcheap.com provider Mobilecheap.com is the default VoIP provider I set on phone port 2. When I call out 123-39-45678 for a mobile call, 123 is replaced with 09. Therefore, 09-39-45678 is the actual phone number called out via Mobilecheap.com provider Ring & Tone Country Specific Ring & ToneRing Parameters Tone ParametersFlash-hook Special Dial CodesOption QoS Quality of Service Click ClearPrioritization HighTable 4 DSCP Mapping Table DSCP Mapping TableWireless Router Device Standard DSCPOutbound IP Throttling LAN to WAN Inbound IP Throttling WAN to LAN VoIP Normal PCs Restricted PC Connection DiagramInformation and Settings Example QoS for your NetworkAdvanced setting by using IP throttling Mission-critical applicationVoice application Restricted ApplicationChapter 4 Configuration Virtual Server “Port Forwarding” Add Virtual Server Internal IPExample IP AddressEdit DMZ Host Edit One-to-One NAT Network Address Translation Global IP AddressSelect the Apply button to apply your changes Table 5 Well-known and registered Ports Example List of some well-known and registered port numbersPort Number ProtocolTime Schedule Click Edit Configuration of Time ScheduleEdit a Time Slot Delete a Time SlotAdvanced Management and IGMP Static RouteDynamic DNS Check Email Device Management Embedded Web Server 2 Management IP accountsUniversal Plug and Play UPnP SNMP V1 andSNMP SNMP Version SNMPv2c and SNMPv3From RFC1650 EtherLike-MIB From RFC 1493 Bridge MIBFrom RFC 1471 PPP/LCP MIB From RFC 1472 PPP/Security MIBIGMP Save Configuration to FlashLogout Chapter 5 Troubleshooting Problems starting up the routerProblems with the LAN Interface ProblemAPPENDIX A Product Support and Contact Information Contact Billion WORLDWIDE
Top Page Image Contents