Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

o Stateful and Normalization Suppression: Ignores dropped retransmit, out of
connection, invalid flags, invalid sequence, invalid ack, unsolicited udp, unsolicited icmp,
out of allowed policy.
o Stateful, Normalization, and Frag Suppression: Ignores everything that "Stateful
and Normalization Suppression" ignores as well as events related to fragmentation.
o Stateful, Frag, and Verifier Suppression: Ignores everything "Stateful,
Normalization, and Frag Suppression" ignores as well as verifier-related events.
o Tap Mode: Ignores dropped retransmit, out of connection, invalid flags, invalid
sequence, invalid ack, max ack retransmit, packet on closed connection.
For a more comprehensive list of which Events are ignored in Stateful and Normalization
Suppression; Stateful, Normalization, and Frag Suppression; Stateful, Frag, and Verifier
Suppression; and Tap modes, see Advanced Logging Policy Modes in the Reference section.
Silent TCP Connection Drop: When Silent TCP Connection Drop is on, a RST packet is only sent
to the local stack. No RST packet is sent on the wire. This reduces the amount of information sent
back to a potential attacker.
If you enable the Silent TCP Connection Drop you must also adjust the DISCONNECT Timeout.
Possible values for DISCONNECT Timeout range from 0 seconds to 10 minutes. This must be set high
enough that the connection is closed by the application before it is closed by the IDF Client Plug-in.
Factors that will affect the DISCONNECT Timeout value include the operating system, the applications
that are creating the connections, and network topology.
Enable Debug Mode: When in debug mode, the client plug-in captures a certain number of
packets (specified by the setting below: Number of Packets to retain in Debug Mode). When a
rule is triggered and debug mode is on, the Client Plug-in will keep a record of the last X packets
that passed before the rule was triggered. It will return those packets to the Server Plug-in as
Client Plug-in Debug Events. Note that debug mode can very easily cause excessive log
generation and should only be used under Client Services supervision.
Number of Packets to retain in Debug Mode: The number of packets to retain and log when
debug mode is on.
Lightweight Normalization: In this mode TCP segments are re-ordered in a more efficient way,
but modifications to traffic are not allowed.
Fragment Timeout: How long to keep fragmented packets.
Maximum number of fragmented IP packets to keep: If configured to do so, the DPI Rules
will edit the content of a packet (or packet fragment) if that content is considered suspicious. This
setting determines how long after editing to wait for the remaining packet fragments before
discarding the packet.
Send ICMP to indicate fragmented packet timeout exceeded: Whether not to indicate to
remote Computer with an ICMP packet that a connection timeout has been exceeded
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 62 -