Manual

87
Chapter 9 - Conguring Firewall/NAT Settings
ASUS SL1200
Table 9.6. DoS Protection Conguration Parameters
Field Description
SYN Flooding Check or un-check this option to enable or disable protection
against SYN Flood attacks. This attack involves sending
connection requests to a server, but never fully completing
the connections. This will cause some computers to get into
a “stuck state” where they cannot accept connections from
legitimate users. (“SYN” is short for “SYNchronize”; this is the
rst step in opening an Internet connection). You can select
this box if you wish to protect the network from TCP SYN
ooding. By default, SYN Flood protection is enabled.
Winnuke Check or un-check this option to enable or disable protection
against Winnuke attacks. Some older versions of the
Microsoft Windows OS are vulnerable to this attack. If the
computers in the LAN are not updated with recent versions/
patches, you are advised to enable this protection by check-
ing this check box.
MIME Flood
Check or un-check this option to enable or disable protection
against MIME attacks. You can select this box to protect the
mail server in your network against MIME ooding.
FTP Bounce Check or un-check this option to enable or disable protection
against FTP bounce attack. In its simplest terms, the attack
is based on the misuse of the PORT command in the FTP
protocol. An attacker can establish a connection between the
FTP server machine and an arbitrary port on another system.
This connection may be used to bypass access controls that
would otherwise apply.
I P U n a l i g n e d Ti m e
Stamp
Check or un-check this option to enable or disable protection
against unaligned IP time stamp attack. Certain operating
systems will crash if they receive a frame with the IP
timestamp option that isn’t aligned on a 32-bit boundary.
S e q u e n c e N u m b e r
Prediction Check
Check or un-check this option to enable or disable protection
against TCP sequence number prediction attacks. For
TCP packets, sequence number is used to guard against
accidental receipt of unintended data and malicious use
by the attackers if the ISN (Initial Sequence Number) is
generated randomly. Forged packets w/ valid sequence
numbers can be used to gain trust from the receiving host.
Attackers can then gain access to the compromised system.
This attack affects only the TCP packets originated or
terminated at the router.