Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

TCP
The Firewall Rule engine, by default, performs a series of checks on fragmented packets. This is
default behavior and cannot be reconfigured. Packets with the following characteristics are dropped:
o Invalid fragmentation flags/offset: A packet is dropped when either the DF and MF
flags in the IP header are set to 1, or the header contains the DF flag set to 1 and an
Offset value different than 0.
o First fragment too small: A packet is dropped if its MF flag is set to 1, its Offset
value is at 0, and it has total length of less than 120 bytes (the maximum combined
header length).
o IP fragment out of boundary: A packet is dropped if its Offset flag value combined
with the total packet length exceeds the maximum datagram length of 65535 bytes.
o IP fragment offset too small: A packet is dropped if it has a non-zero Offset flag with
a value that is smaller than 60 bytes.
TCP Packet Inspection
Deny TCP packets containing CWR, ECE flags: These flags are set when there is network
congestion.
RFC 3168 defines two of the six bits from the Reserved field to be used for ECN (Explicit
Congestion Notification), as follows:
Bits 8 to 15: CWR-ECE-URG-ACK-PSH-RST-SYN-FIN
TCP Header Flags Bit Name Reference:
Bit 8: CWR (Congestion Window Reduced) [RFC3168]
Bit 9: ECE (ECN-Echo) [RFC3168]
Automated packet transmission (such as that generated by a denial of service attack, among other
things) will often produce packets in which these flags are set.
Enable TCP stateful inspection: Enable stateful inspection at the TCP level. If you enable
stateful TCP inspection, the following options become available:
o Enable TCP stateful logging: TCP stateful inspection events will be logged.
o Limit the number of incoming connections from a single Computer to: Limiting
the number of connections from a single Computer can lessen the effect of a denial of
service attack.
o Limit the number of outgoing connections to a single Computer to: Limiting the
number of outgoing connections to a single Computer can significantly reduce the effects
of Nimda-like worms.
o Limit the number of half-open connections from a single Computer to: Setting a
limit here can protect you from DoS attacks like SYN Flood. Although most servers have
timeout settings for closing half-open connections, setting a value here can prevent halfopen
connections from becoming a significant problem. If the specified limit for SYN-
SENT(remote) entries is reached, subsequent TCP packets from that specific Computer
will be dropped.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 35 -