When Intrusion Detection feature is enabled, any users will not be able to hack into your ADSL Router.
1 At the Security Interface Configuration page, click 'Enabled' at the 'Intrusion Detection Enabled' option and click 'Change State'.
NOTE! Firewall option has to be enabled before Intrusion Detection can be enabled.
2 Select and enter the required information.
Use Blacklist | Select this option to
enable/disable the blacklisting feature. Blacklisting denies an external
host access to the system if Intrusion Detection Setting (IDS) has
detected an intrusion from that host. Access to the network is denied
for ten minutes. true: Enables blacklisting of an external host if IDS has detected an intrusion from that host. false: Disables blacklisting of an external host if IDS has detected an intrusion from that host. |
Use Victim Protection | Select this option to
enable/disable the victim protection Intrusion Detection Setting (IDS).
Enabling this command protects the victim from an attempted spoofing
attack. false: Disables victim protection. true: Enables victim protection and blocks packets destined for the victim host. Web spoofing allows an attacker to create a 'shadow' copy of the World Wide Web. All access to the shadow Web goes through the attacker's machine, so that the attacker can monitor all of the victim's activities and send false data to or from the victim's machine. If Victim Protection is enabled, packets destined for the victim host of a spoofing style attack are blocked. |
DOS Attack Block Duration | Specify the length of time
(in seconds) that the firewall blocks suspicious hosts once a DOS attack
attempt has been detected by the firewall. By default, a duration of 1800 seconds (30 minutes) is set. A DOS (Denial of Service) attack is an attempt by an attacker. The use of this feature prevent these legitimate users from using a service. If a DOS attack is detected, all suspicious hosts are blocked by the firewall for a set time limit. This option allows you to specify the duration of the block time limit. |
Scan Attack Block Duration | Specify the length of time (in seconds) that the firewall blocks all suspicious hosts for, after it has detected scan activity on the Firewall. The default time is 86400 (one day). |
Victim Protection Block Duration | Specify the length of time (in seconds) that the firewall blocks packets destined for the victim of a spoofing style attack. The default length of time is 600 seconds (10 minutes) |
Maximum TCP open Handshaking Count | The maximum number (per
second) of unfinished TCP handshaking sessions that are allowed before a
SYN Flood attempt is detected.
SYN Flood is a DOS attack. When establishing normal TCP connections, three packets are exchanged:
If the host sends unreachable source addresses in the SYN packet, the server sends the SYN/ACK packets to the unreachable addresses and keeps resending them. This creates a backlog queue of unacknowledged SYN/ACK packets. Once the queue is full, the system will ignore all incoming SYN requests and no legitimate TCP connections can be established. Once the maximum number of unfinished TCP handshaking sessions is reached, an attempted DOS attack is detected. |
Maximum Ping Count |
This command sets the maximum number of pings per second that is allowed by firewall before an Echo Storm is detected. Once the maximum number of pings per second is reached, an attempted DOS attack is detected. The default number of packets is 15. Echo Storm is a DOS attack. An attacker sends oversized ICMP datagrams to the system using the 'ping' command. This can cause the system to crash, freeze or reboot, resulting in denial of service to legitimate users. |
Maximum ICMP Count |
This option allows you to set the maximum number of ICMP packets per second that is allowed by firewall before an ICMP Flood attempt is detected. The default number of packets is 100. An ICMP Flood is a DOS attack. An attacker tries to flood the network with ICMP packets in order to prevent transportation of legitimate network traffic. |
3
Click 'Apply'.
4
To save the changes permanently, click Save Config (Configuration
option). Changes that are not saved will be lost the next time you power off
or restart your Router.
[top]