Billion BiPAC 7402NX(L) 802.11n 3G/ADSL2+ (VPN) Firewall Router
Table 2: Hacker attack types recognized by the IDS
Intrusion Name
Ascend Kill
WinNuke
Smurf
Land attack
Echo/CharGen Scan
Echo Scan
CharGen Scan
X’mas Tree Scan
IMAP
SYN/FIN Scan
SYN/FIN/RST/ACK Scan
Net Bus Scan
Back Orifice Scan
SYN Flood
ICMP Flood
ICMP Echo
Detect Parameter 
Blacklist
Ascend Kill data |
| Src IP | ||
|
|
|
|
|
TCP |
|
|
|
|
Port 135, 137~139, | Src IP | |||
Flag: URG |
|
|
| |
|
|
|
| |
ICMP type 8 |
|
| Dst IP | |
Des IP is broadcast | ||||
|
|
| ||
SrcIP = DstIP |
|
| ||
|
| |||
UDP Echo Port and |
| |||
CharGen Port |
|
| ||
|
|
|
|
|
UDP | Dst | Port | = | Src IP |
Echo(7) |
|
|
| |
UDP | Dst | Port | = | Src IP |
CharGen(19) |
|
| ||
TCP Flag: X’mas |
| Src IP | ||
|
|
|
|
|
TCP Flag: SYN/FIN
DstPort: IMAP(143) Src IP
SrcPort: 0 or 65535
TCP,
No Existing session
And Scan Hosts Src IP more than five.
TCP
No Existing session DstPort = Net Bus SrcIP
12345,12346, 3456
UDP, DstPort =
SrcIP Orifice Port (31337)
Max TCP Open Handshaking Count (Default 100 c/sec)
Max ICMP Count (Default 100 c/sec)
Max PING Count (Default 15 c/sec)
Type of Block Drop Packet Duration
DoS | Yes | |
|
| |
DoS | Yes | |
|
| |
Victim | Yes | |
Protection | ||
| ||
|
| |
| Yes | |
|
| |
| Yes | |
|
| |
Scan | Yes | |
|
| |
Scan | Yes | |
|
| |
Scan | Yes | |
|
| |
Scan | Yes | |
|
| |
Scan | Yes | |
|
| |
Scan | Yes | |
|
| |
Scan | Yes | |
|
| |
|
| |
|
| |
|
|
Show Log
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Src IP: Source IP | Src Port: Source Port |
Dst Port: Destination Port | Dst IP: Destination IP |
66
