SpeedStream Router User Guide
•Fragmented TCP Packet:
As discussed in the Invalid IP Packet Fragment description, packets may be fragmented in transit. While it is entirely valid to fragment a TCP packet, this is rarely done because of a process called “MTU discovery” that occurs when two hosts begin communicating. The rarity of TCP packet fragmentation makes its occurrence suspicious and could indicate a flawed network stack exploit attempt.
•Fragmented TCP Header:
This indicates that the TCP header in the packet was split into multiple IP fragments. This never normally occurs and is most likely a flawed network stack exploit attempt.
•Fragmented UDP Header:
This indicates that the IP header in the packet was split into multiple IP fragments. This never normally occurs and is most likely a flawed network stack exploit attempt.
•Fragmented ICMP Header:
This indicates that the ICMP header in the packet was split into multiple IP fragments. This never normally occurs and is most likely a flawed network stack exploit attempt.
When logging is selected for a particular offending packet, the ADS will write an entry to the firewall log once a minute for as long as the attack persists. This allows one to tell that a
To enable ADS:
•On the main menu, click Advanced Setup, then click Firewall, and then click ADS. The Attack Detection System Configuration screen displays.
To globally enable ADS without losing any of the individual packet types:
•Select Enable Attack Detection.
To filter, or drop, a packet type:
•Select Filter to the right of the desired option.
To log a packet type to the Firewall
Event Log:
•Select Log to the right of the desired function.
Note Filtering and logging are independent operations. You can select either, neither or both.
To save the new settings:
•Click Apply.
35