D-Link DRO-210i manual IDS Configuration

Firewall

Select Firewall → IDS Configuration to configure the IDS Configuration as explained below.

Web UI

IDS Configuration

Enable IDS	Select Enable to activate the IDS.
Flood Attack	Select Enable to activate all types of flood attacks available on this router
	i.e. SYN flood attack, ICMP flood attack, ICMP Echo storm attack. In
	these attacks, packets are flooded continuously on the target machine.
Ping of Death	Select Enable to activate a form of DoS (denial of service) attack. This
	attack consists of flood of large-sized ping requests designed to disrupt
	the normal activity of a system.
Boink Attack	Select Enable to activate the Boink attack. It involves the perpetrator
	sending corrupt UDP packets to host.
Smurf Attack	Select Enable to activate Smurf attack. This is named after its exploit
	program and is the most recent network intrusions against hosts.
TCP SYN Attack	Select Enable to activate TCP attacks like SYN/ACK attack, FIN attack
	and RESET attack. These attacks exploit the three-way TCP handshaking.
Port scan Attack	Select Enable to activate the port scan attacks like Netbus scan, Back
	orifice scan, Echo chargen scan, UDP echo scan, Chargen scan, IMAP
	scan. All ports are scanned under this attack.
Land Attack	Select Enable to activate the Land attack. In this attack the perpetrator
	sends spoofed packet(s) with the SYN flag set to the victim's machine on
	any open port that is listening. If the packet contains the same source and
	destination IP address as the host, the victim's machine could hang or
	reboot.
Winnuke Attack	Select Enable to activate Denial of service attack. This attack sends OOB
	data to an established connection on port 139 (NetBIOS), to any windows
	user using 95/NT/3.x.
XMAS-Tree Attack	Select Enable to activate the XMAS Tree attack. This attack uses the DoS
	technique that sets all TCP header flags to ‘ON’ in an attempt to gain
	information regarding a network.
Ascend kill Attack	Select Enable to activate the Ascend Kill attack. This attack makes the
	remote Ascend router reboot by sending it a UDP packet containing
	special data on port 9(discard).

After entering all the information press the Apply button. The attacks are logged on the Intrusion Log. The IP address of the attacker is blacklisted to prevent any further attacks.

Note: To ensure the highest level of security in a	network, it is recommended to
￿ enable detection of all the attacks supported by the router.

Dlink DRO-210i User Guide 47