Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Stateful Configurations
IDF's Stateful Configuration mechanism analyzes each packet in the context of traffic history, correctness
of TCP and IP header values, and TCP connection state transitions. In the case of stateless protocols like
UDP and ICMP, a pseudo-stateful mechanism is implemented based on historical traffic analysis. Packets
are handled by the stateful mechanism as follows:
1. A packet is passed to the stateful routine if it has been allowed through by the static Firewall Rule
conditions,
2. The packet is examined to determine whether it belongs to an existing connection by checking a
connection table created by the stateful mechanism for matching end points, and
3. The TCP header is examined for correctness (e.g. sequence numbers, flag combinations, etc.).
Stateful Configuration icons:
Normal Stateful Configurations
The Stateful Configuration screen lets you define multiple stateful inspection configurations which you
can then include in your Security Profiles. From the toolbar or shortcut menu you can:
Create New ( New) Stateful Configurations from scratch
Import ( ) Stateful Configuration from an XML file
Examine or modify the Properties ( ) of an existing Stateful Configuration
Duplicate ( ) (and then modify) existing Stateful Configurations
Delete a Stateful Configuration ( )
Export ( ) one or more Stateful Configurations to an XML file. (Either export them all by click
the Export... button, or choose from the drop-down list to export only those that are selected or
displayed)
Clicking New ( New) or Properties ( ) displays the Stateful Configuration properties window.
Stateful Configuration Properties
General Information
Name: The name of the Stateful Configuration.
Description: Type a description of the Stateful Configuration. This description will only appear
here.
IP Packet Inspection
Deny all incoming fragmented packets: If this option is enabled, all fragmented packets are
dropped with the following log entry: "IP fragmented packet". The one exception to this rule is
the presence of packets with a total length smaller than the IP header length. Such packets are
dropped silently.
Attackers sometimes create and send fragmented packets in an attempt to bypass Firewall Rules.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 34 -