Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Analysis
The Analysis screen allows users to enable and configure traffic analysis settings on all or selected
Computers.
Detection Enabled: Turn traffic analysis on or off.
Computers/Networks on which to perform traffic analysis: Choose from the drop-down list
the IPs to protect. Choose from existing IP Lists. (You can use the Components > IP Lists
screen to create an IP List specifically for this purpose.)
Do not analyze traffic coming from : Select from a set of IP Lists which Computers and
networks to ignore. (As above, you can use the Components > IP Lists screen to create an IP
List specifically for this purpose.)
For each type of attack, the Client Plug-in can be instructed to send the information to the IDF Server
Plug-in where an alert will be triggered. You can configure the Server Plug-in to send an email notification
when the alerts are triggered. (See System > System Settings > Notifications. The Alerts are:
"Network or Port Scan Detected", "Computer OS Fingerprint Probe Detected", "TCP Null Scan Detected",
"TCP FIN Scan Detected", and "TCP Xmas Scan Detected.") Select Notify IDF Server Immediately for
this option.
Once an attack has been detected, you can instruct the client plug-ins to block traffic from the source IPs
for a period of time. Use the Block Traffic drop-down lists to set the number of minutes.
Computer OS Fingerprint Probe: The Client Plug-ins will recognize and react to active TCP
stack OS fingerprinting attempts.
Network or Port Scan: The Client Plug-ins will recognize and react to port scans.
TCP Null Scan: The Client Plug-ins will refuse packets with no flags set.
TCP SYNFIN Scan: The Client Plug-ins will refuse packets with only the SYN and FIN flags set.
TCP Xmas Scan: The Client Plug-ins will refuse packets with only the SYN, URG, and PSH flags
set.
"Computer OS Fingerprint Probe" and "Network or Port Scans" differ from the other three types of
reconnaissance in that they cannot be recognized by a single packet.
The Client Plug-in reports a Computer or port scan if it detects that a remote IP is visiting an abnormal
ratio of IPs to ports. Normally a client plug-in computer will only see traffic destined for itself, so a port
scan is by far the most common variation that will be detected. If a computer however is acting as a
router or bridge it could see traffic for a number of other computers, making it possible for the client
plug-in to detect a Computer scan (ex. scanning a whole subnet for computers with port 80 open).
Detecting these scans can take several seconds since the client plug-in needs to be able to track failed
connections and decide that there are an abnormal number of failed connections coming from a single
Computer in a relatively short period of time.
The statistical analysis method used in Computer/port scan detection is derived from the "TAPS"
algorithm proposed in the paper "Connectionless Port Scan Detection on the Backbone" published by
Sprint/Nextel and presented at the Malware workshop, held in conjunction with IPCCC, Phoenix, AZ,
USA in April, 2006.
For the "Notify IDF Server Immediately" option to work, the Client Plug-ins must be configured for
Client Plug-in initiated or bi-directional communication. (See System > System Settings >
Computers.) If enabled, the Client Plug-in will initiate a heartbeat to the IDF Server Plug-in
immediately upon detecting the attack or probe.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 65 -