McAfee HISCDE-AB-IA Product Guide - Page 54

The Host IPS firewall offers full support for IPv4 and IPv6 on Windows XP, Windows Vista

Get McAfee HISCDE-AB-IA - Host Intrusion Prevention PDF manuals and user guides View all McAfee HISCDE-AB-IA manuals
Add to My Manuals
Save this manual to your list of manuals

Page 54 highlights

Configuring Firewall Policies Overview of Firewall policies It likewise supports arbitrary non-IP protocols, but cannot detect any network or transport layer parameters for them. At best, this allows the administrator to block or allow these network layer protocols. The numbers associated with the non-IP protocols are based on the Ethernet numbers defined by the Internet Assigned Numbers Authority (IANA), and published at http://www.iana.org/assignments/ethernet-numbers. The Host IPS firewall offers full support for IPv4 and IPv6 on Windows XP, Windows Vista, Windows Server 2008, and Windows 7. Transport Layers IP can be used as the network protocol for a number of different transport protocols. In practice, four are commonly used: TCP, the User Datagram Protocol (UDP), the Internet Control Message Protocol version 4 and version 6 (ICMPv4 and ICMPv6). TCP TCP is a connection-oriented reliable transport protocol. It guarantees that the data contained in network packets are delivered reliably, and in order. It also controls the rate at which data is received and transmitted. This entails a certain amount of overhead, and makes the timing of TCP operations unpredictable when network conditions are sub-optimal. TCP is the transport layer for the vast majority of application protocols. HTTP, FTP, SMTP, RDP, SSH, POP, and IMAP all use TCP. TCP multiplexes between application-layer protocols using the concept of "ports." Each TCP packet contains a source and destination port number, from 0 to 65535. Usually, the server end of a TCP connection listens for connections on a fixed port. Ports 0 to 1023 are reserved as "well-known ports." Numbers in this range are usually assigned to protocols by the IANA (www.iana.org/assignments/protocol-numbers), and most operating systems require a process to have special permissions to listen on one of these ports. Firewall rules are generally constructed to block certain ports and allow others, thereby limiting the activities that can occur on the network. UDP UDP is a connectionless best-effort transport protocol. It makes no guarantees about reliability or packet order, and lacks flow control features. In practice, it has some very desirable properties for certain classes of traffic. UDP is often used as a transport protocol for performance-critical applications (which might implement some of the reliability and packet-ordering features of TCP in the application protocol), and in real-time multi-media applications, where a dropped packet causes only a momentary glitch in the data stream, and is thus more acceptable than a stream that has to stop and wait for re-transmission. IP telephony and videoconferencing software often uses UDP, as do some multi-player video games. The UDP multiplexing scheme is identical to that of TCP: each datagram has a source and destination port, ranging from 0 to 65535. ICMP ICMP is used as an out-of-band communication channel between IP hosts. It is useful in troubleshooting, and necessary to the proper function of an IP network, as it is the error reporting mechanism. IPv4 and IPv6 have separate, unrelated ICMP protocol variants. ICMPv4 is often referred to as simply ICMP. 54 McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
It likewise supports arbitrary non-IP protocols, but cannot detect any network or transport layer
parameters for them. At best, this allows the administrator to block or allow these network
layer protocols. The numbers associated with the non-IP protocols are based on the Ethernet
numbers defined by the Internet Assigned Numbers Authority (IANA), and published at
.
The Host IPS firewall offers full support for IPv4 and IPv6 on Windows XP, Windows Vista,
Windows Server 2008, and Windows 7.
Transport Layers
IP can be used as the network protocol for a number of different transport protocols. In practice,
four are commonly used: TCP, the User Datagram Protocol (UDP), the Internet Control Message
Protocol version 4 and version 6 (ICMPv4 and ICMPv6).
TCP
TCP is a connection-oriented reliable transport protocol. It guarantees that the data contained
in network packets are delivered reliably, and in order. It also controls the rate at which data
is received and transmitted. This entails a certain amount of overhead, and makes the timing
of TCP operations unpredictable when network conditions are sub-optimal.
TCP is the transport layer for the vast majority of application protocols. HTTP, FTP, SMTP, RDP,
SSH, POP, and IMAP all use TCP.
TCP multiplexes between application-layer protocols using the concept of “ports.” Each TCP
packet contains a source and destination port number, from 0 to 65535. Usually, the server
end of a TCP connection listens for connections on a fixed port.
Ports 0 to 1023 are reserved as “well-known ports.” Numbers in this range are usually assigned
to protocols by the IANA (
www.iana.org/assignments/protocol-numbers
), and most operating
systems require a process to have special permissions to listen on one of these ports.
Firewall rules are generally constructed to block certain ports and allow others, thereby limiting
the activities that can occur on the network.
UDP
UDP is a connectionless best-effort transport protocol. It makes no guarantees about reliability
or packet order, and lacks flow control features. In practice, it has some very desirable properties
for certain classes of traffic.
UDP is often used as a transport protocol for performance-critical applications (which might
implement some of the reliability and packet-ordering features of TCP in the application protocol),
and in real-time multi-media applications, where a dropped packet causes only a momentary
glitch in the data stream, and is thus more acceptable than a stream that has to stop and wait
for re-transmission. IP telephony and videoconferencing software often uses UDP, as do some
multi-player video games.
The UDP multiplexing scheme is identical to that of TCP: each datagram has a source and
destination port, ranging from 0 to 65535.
ICMP
ICMP is used as an out-of-band communication channel between IP hosts. It is useful in
troubleshooting, and necessary to the proper function of an IP network, as it is the error reporting
mechanism.
IPv4 and IPv6 have separate, unrelated ICMP protocol variants. ICMPv4 is often referred to as
simply ICMP.
Configuring Firewall Policies
Overview of Firewall policies
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
54