ZyXEL GS-1548 User Guide - Page 89

Auto Denial of Service (DoS), 15.1 About Denial of Service Attacks, 15.1.1 DoS Attacks Summary

Get ZyXEL GS-1548 PDF manuals and user guides View all ZyXEL GS-1548 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 89 highlights

CHAPTER 15 Auto Denial of Service (DoS) This chapter shows you how to configure automatic Denial of Service prevention on the Switch. 15.1 About Denial of Service Attacks Denial of Service (DoS) attacks try to disable a device or network so users no longer have access to network resources. The Switch has features which automatically detect and thwart currently known DoS attacks. 15.1.1 DoS Attacks Summary The following table summarizes the types of attacks the Switch can prevent. Table 29 DoS Attack Summary ATTACK DESCRIPTION Land Attacks These attacks result from sending a specially crafted packet to a machine where the source host IP address is the same as the destination host IP address. The system attempts to reply to itself, resulting in system lockup. Blat Attacks These attacks result from sending a specially crafted packet to a machine where the source host port is the same as the destination host port. The system attempts to reply to itself, resulting in system lockup. SYNFIN scans SYNchronization (SYN), ACKnowledgment (ACK) and FINish (FIN) packets are used to initiate, acknowledge and conclude TCP/IP communication sessions. The following scans exploit weaknesses in the TCP/IP specification and try to illicit a response from a host to identify ports for an attack: Scan SYNFIN - SYN and FIN bits are set in the packet. Xmascan - TCP sequence number is zero and the FIN, URG and PSH bits are set. NULL Scan - TCP sequence number is zero and all control bits are zeroes. SYN with port < 1024 - SYN packets with source port less than 1024. GS-1524/GS-1548 User's Guide 89

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
GS-1524/GS-1548 User’s Guide
89
C
HAPTER
15
Auto Denial of Service (DoS)
This chapter shows you how to configure automatic Denial of Service prevention
on the Switch.
15.1
About Denial of Service Attacks
Denial of Service (DoS) attacks try to disable a device or network so users no
longer have access to network resources. The Switch has features which
automatically detect and thwart currently known DoS attacks.
15.1.1
DoS Attacks Summary
The following table summarizes the types of attacks the Switch can prevent.
Table 29
DoS Attack Summary
ATTACK
DESCRIPTION
Land Attacks
These attacks result from sending a specially crafted packet to a
machine where the source host IP address is the same as the
destination host IP address. The system attempts to reply to
itself, resulting in system lockup.
Blat Attacks
These attacks result from sending a specially crafted packet to a
machine where the source host port is the same as the
destination host port. The system attempts to reply to itself,
resulting in system lockup.
SYNFIN scans
SYNchronization (SYN), ACKnowledgment (ACK) and FINish (FIN)
packets are used to initiate, acknowledge and conclude TCP/IP
communication sessions. The following scans exploit weaknesses
in the TCP/IP specification and try to illicit a response from a host
to identify ports for an attack:
Scan SYNFIN
- SYN and FIN bits are set in the packet.
Xmascan
- TCP sequence number is zero and the FIN, URG and
PSH bits are set.
NULL Scan
- TCP sequence number is zero and all control bits
are zeroes.
SYN with port < 1024
- SYN packets with source port less than
1024.