Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

ESTABLISHED Timeout: How long to stay in the ESTABLISHED state before closing the
connection.
ERROR Timeout: How long to maintain a connection in an Error state. (For UDP connections, the
error can be caused by any of a variety of UDP problems. For TCP connections, the errors are
probably due to packets being dropped by the firewall.)
DISCONNECT Timeout: How long to maintain idle connections before disconnecting.
CLOSE_WAIT Timeout: How long to stay in the CLOSE-WAIT state before closing the
connection.
CLOSING Timeout: How long to stay in the CLOSING state before closing the connection.
LAST_ACK Timeout: How long to stay in the LAST-ACK state before closing the connection.
Boot Start Timeout: For gateway use. When a gateway is booted, there may already exist
established connections passing through the gateway. This timeout defines the amount of time to
allow non-SYN packets that could be part of a connection that was established before the
gateway was booted to close.
Cold Start Timeout: Amount of time to allow non-SYN packets that could belong to a connection
that was established before the stateful mechanism was started.
UDP Timeout: Maximum duration of a UDP connection.
ICMP Timeout: Maximum duration of an ICMP connection.
Allow Null IP: Allow or block packets with no source and/or destination IP address.
Block IPv6: Block or Allow IPv6 packets. (DPI Filtering of IPv6 traffic is not supported. It can
only be blocked or allowed.)
Connection Cleanup Timeout: Time between cleanup of closed connections (see next).
Maximum Connections per Cleanup: Maximum number of closed connections to cleanup per
periodic connection cleanup (see previous).
Block Same Src-Dest IP Address: Block or allow packets with same source and destination IP
address. (Doesn't apply to loopback interface.)
Maximum TCP Connections: Maximum simultaneous TCP Connections.
Maximum UDP Connections: Maximum simultaneous UDP Connections.
Maximum ICMP Connections: Maximum simultaneous ICMP Connections.
Maximum Events per Second: Maximum number of events that can be written per second.
TCP MSS Limit: The MSS is the Maximum Segment Size (or largest amount of data) that can be
sent in a TCP packet without being fragmented. This is usually established when two computers
establish communication. However, in some occasions, the traffic goes through a router or switch
that has a smaller MSS. In this case the MSS can change. This causes retransmission of the
packets and the Client Plug-in logs them as "Dropped Retransmit”. In cases where there are large
numbers of Dropped Retransmit event entries, you may wish to lower this limit and see if the
volume is reduced.
Number of Event Nodes: The maximum amount of kernel memory the driver will use to store
log/event information for folding at any one time.
Event folding occurs when many Events of the same type occur in succession. In such cases, the
Client Plug-in will "fold" all the events into one.
Ignore Status Code: This option lets you ignore certain types of Events. If, for example, you
are getting a lot of "Invalid Flags" you can simply ignore all instances of that Event.
Ignore Status Code: Same as above.
Ignore Status Code: Same as above.
Advanced Logging Policy:
o Bypass: No filtering of Events. Overrides the "Ignore Status Code" settings (above) and
other advanced settings, but does not override logging settings defined in the IDF
Server Plug-in. For example, if Stateful Configuration logging options set from a Stateful
Configuration Properties window in the IDF Server Plug-in will not be affected.
o Default: Will switch to "Tap Mode" (below) if the engine is in Tap Mode, and will switch
to "Normal" (above) if the engine is in Inline Mode.
o Normal: All Events are logged except dropped retransmits.
o Backwards Compatibility Mode: For Trend Micro support use only.
o Verbose Mode: Same as "Normal" but including dropped retransmits.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 61 -