Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Packet Processing Sequence
Both incoming and outgoing network traffic gets fed through a pipeline of modules:
Verification: Basic checks for validity of the packet
Micro Filter: Basic firewall bypass rules are enforced at this layer
Blacklist: Maintains a list of known bad IPs as used by the Traffic Analysis feature
Fragmentation: Fragments packets that are larger than the MTU
Firewall Rules : All packets not processed by the Micro Filter are processed by the Firewall
Stateful Inspection, SSL Decryption, and DPI Rules: Acts as one module where the following
functions are performed:
o Stateful Inspection: Maintains known connections that are valid for a response. This
feature also controls the connection limits and does SYN Flood and ACK Storm protection
o SSL Decryption: If required and configured this feature decrypts the SSL protected
traffic for analysis by the DPI engine
o DPI: Deep Packet Inspection engine that does pattern matching and custom code
operations
Reassembly: Reassembles fragmented packets for later use by the DPI engine
Although incoming and outgoing traffic flow through the pipeline in the same order, the internal sub-order
inside the Stateful Inspection, SSL, and DPI module depends on traffic direction:
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 142 -