Symantec 10521146 Administration Guide - Page 165

Detecting 165 Configuring sensor detection UDP Flood Alert Threshold UDP Flood Alert Threshold regulates the level at which the sensor notifies you of a UDP flood. If the sensor detects a greater percentage of unacknowledged UDP connections than the Threshold, it triggers a flood event. The default is set to 0.50 (50%) for a high level of sensitivity. Valid values range from 0 to 1. Increase the value to make the sensor less sensitive; decrease the value to make it more sensitive. A value of 1% is extremely sensitive, which impacts system performance somewhat if it generates alerts. It interacts with Streak Interval and UDP Number of Streak Packets, and affects performance slightly if changed. Note: In versions prior to 4.0, this parameter controlled input and detected both portscans and floods. Now this parameter controls output and detects either port scans or floods separately. Slow Scan Alert Threshold Slow Scan Alert Threshold regulates the level at which the sensor notifies you of sweep or scan activity. The sensor detects attempts to connect to the same port across multiple hosts, which can indicate sweep activity. The sensor also detects attempts to connect to the same host on multiple ports, which can indicate scan activity. If the number of attempts breaches the Threshold, it triggers a slow scan event. The default is set to 7, and valid values range from 3 to 15, inclusive. If your network traffic commonly includes many dropped or unacknowledged connections, you can increase the value to adjust the sensor's tolerance for this activity. You can decrease the value to make the sensor more sensitive to this activity, at the cost of affecting performance slightly. Saturation parameters The following parameters regulate the percentage of a variety of types of traffic that the sensor tolerates before it notifies you. Symantec Network Security provides counter-based detection of floods and denial-of-service attacks such as resource reservation and pipe filling. For example, in a reservation attack such as SYNflood, the attacker sends more SYN packets than the queue can hold, and thus reserves otherwise available resources and prevents new connections. In a pipe-filling attack, the attacker saturates the links by generating so much traffic on a network connection that it clogs a traffic pipe.