Chapter 30 ADP

The following table describes the fields in this screen.

Table 169 ADP > Profile > Protocol Anomaly

LABEL

DESCRIPTION

Name

This is the name of the profile. You may use 1-31 alphanumeric characters,

 

underscores(_), or dashes (-), but the first character cannot be a number. This value

 

is case-sensitive. These are valid, unique profile names:

 

MyProfile

 

mYProfile

 

Mymy12_3-4

 

These are invalid profile names:

 

1mYProfile

 

My Profile

 

MyProfile?

 

Whatalongprofilename123456789012

 

 

HTTP Inspection/TCP Decoder/UDP Decoder/ICMP Decoder

 

 

Name

This is the name of the protocol anomaly rule. Click the Name column heading to

 

sort in ascending or descending order according to the protocol anomaly rule name.

 

 

Activation

Click the icon to enable or disable a rule or group of rules.

 

 

Log

Select whether to have the ZyWALL generate a log (log), log and alert (log alert) or

 

neither (no) when traffic matches this anomaly rule. See Chapter 45 on page 715 for

 

more on logs.

 

 

Action

Select what the ZyWALL should do when a packet matches a rule.

 

none: The ZyWALL takes no action when a packet matches the signature(s).

 

block: The ZyWALL silently drops packets that matches the rule. Neither sender nor

 

receiver are notified.

 

 

OK

Click OK to save your settings to the ZyWALL, complete the profile and return to the

 

profile summary page.

 

 

Cancel

Click Cancel to return to the profile summary page without saving any changes.

 

 

Save

Click Save to save the configuration to the ZyWALL but remain in the same page.

 

You may then go to the another profile screen (tab) in order to complete the profile.

 

Click OK in the final profile screen to complete the profile.

 

 

30.4 Technical Reference

This section is divided into traffic anomaly background information and protocol anomaly background information.

Traffic Anomaly Background Information

The following sections may help you configure the traffic anomaly profile screen (Section 30.3.4 on page 518)

Port Scanning

An attacker scans device(s) to determine what types of network protocols or services a device supports. One of the most common port scanning tools in use today is Nmap.

 

523

ZyWALL USG 100/200 Series User’s Guide