ZyXEL Communications 794M 6.5 Intrusion Detection, Block Duration

Prestige 794M User’s Guide

Table 33 Firewall: Packet Filters: Add Raw Filter (continued)

LABEL	DESCRIPTION
Apply	Click Apply to save the settings and return to the main Packet Filter screen.
Return	Click Return to discard all changes and go back to the main Packet Filter screen.

6.5 Intrusion Detection

The Prestige’s Intrusion Detection System (IDS) is used to detect hacker attacks and intrusion attempts from the Internet. When you enable IDS on the Prestige, inbound packets are filtered and blocked depending on whether they are detected as possible hacker attacks, intrusion attempts or other connections that the router determines to be suspicious.

If the Prestige detects a possible attack, the source IP or destination IP address will be added to the Blacklist. Any further attempts using this IP address will be blocked for the time period specified in the Block Duration field. The default setting for this function is false (disabled). Some attack types are denied immediately without using the Blacklist function, such as Land attack and Echo/CharGen scan.

The following table lists the types of attacks that the IDS is able to detect and the actions performed.

Table 34 IDS: Detectable Attacks

NAME	PARAMETER	BLACKLIST	TYPE OF BLOCK	DROP PACKET	LOG
			DURATION
Ascend Kill	Ascend Kill data	Source IP	DoS	Yes	Yes
WinNuke	TCP	Source IP	DoS	Yes	Yes
	Port 135, 137~139,
	Flag: URG
Smurf	ICMP type 8	Destination	Victim Protection	Yes	Yes
	Des IP is broadcast	IP
Land attack	SrcIP = DstIP			Yes	Yes
Echo/	UDP Echo Port and			Yes	Yes
CharGen	CharGen Port
Scan
Echo Scan	UDP Dst Port =	Source IP	Scan	Yes	Yes
	Echo(7)
CharGen	UDP Dst Port =	Source IP	Scan	Yes	Yes
Scan	CharGen(19)
X’mas Tree	TCP Flag: X’mas	Source IP	Scan	Yes	Yes
Scan
IMAP	TCP Flag: SYN/FIN	Source IP	Scan	Yes	Yes
SYN/FIN	DstPort: IMAP(143)
Scan	SrcPort: 0 or 65535

71 Chapter 6 Firewall