Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...
Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...
Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Interface<br />
Information<br />
IP<br />
Information<br />
Interface name and Ethernet frame<br />
information. The IN=, OUT=, and<br />
MAC= fields are always present.<br />
Unlike the <strong>Firewall</strong> Event logs, the<br />
DPI Event logging doesn't log<br />
packets on an incoming/outgoing<br />
basis, but based on their<br />
connection flow direction (FWD or<br />
REV). In order to stick with<br />
netfilter/iptables interface logging<br />
conventions, the Client Plug-in<br />
looks at the DPI Rule definition. If<br />
the DPI Rule is an incoming rule<br />
the interface name follows IN=,<br />
and the OUT= field contains<br />
nothing. The opposite is true for<br />
outgoing DPI Rules.<br />
The MAC= field consists of 14 twodigit<br />
hex characters. The first six<br />
are the destination MAC address,<br />
the next six are the source MAC<br />
address, and the last two are the<br />
Ethernet frame type.<br />
The source and destination IPs in<br />
numeric form.<br />
Protocol The "PROTO=" field contains the<br />
name of the protocol, or its<br />
numeric format (in decimal) if it's<br />
not one of the well known values.<br />
Ports The "SPT=" and "DPT=" fields<br />
contains source and destination<br />
ports, if applicable to the protocol<br />
type.<br />
TCP Flags For the TCP protocol, the URG,<br />
ACK, PSH, RST, SYN, FIN fields are<br />
present if the corresponding TCP<br />
header bit was set. The<br />
"RES=0xNN" field is always<br />
present and contains the value of<br />
the reserved TCP bits. The ECN<br />
flags "CWR" and "ECE" will show<br />
up in the two least significant bits<br />
of this field.<br />
ICMP Flags For the ICMP protocol, the<br />
"TYPE=N" field contains the ICMP<br />
type (in decimal) and the<br />
"CODE=N" field contains the ICMP<br />
code (in decimal).<br />
IP<br />
Datagram<br />
Length<br />
The "IPDGLEN=N" field contains<br />
the length of the IP datagram in<br />
decimal format.<br />
Action The "ACTION" field contains the<br />
action taken by the DPI Rule. It<br />
contains one of the strings "Block",<br />
"Reset", "Insert", "Delete",<br />
"Replace", "Log". If the rule or the<br />
DPI engine is operating in detectonly<br />
mode, the action value will be<br />
preceded by "IDS:".<br />
IN=LAN_-_Gigabit OUT=<br />
MAC=FF:FF:FF:FF:FF:FF:00:80:C8:38:79:E3:08:00<br />
IN= OUT=eth2<br />
MAC=00:11:95:B9:A5:AD:00:11:95:B9:A5:B4:08:00<br />
SRC=192.168.5.9 DST=192.168.5.255<br />
SRC=192.168.5.8 DST=192.168.5.255<br />
PROTO=TCP<br />
PROTO=UDP<br />
PROTO=ICMP<br />
SPT=137 DPT=137<br />
SPT=41794 DPT=3328<br />
RES=0x00 ACK<br />
RES=0x00 SYN ACK<br />
TYPE=11 CODE=0<br />
TYPE=8 CODE=0<br />
IPDGLEN=0<br />
IPDGLEN=60<br />
ACTION=Log<br />
ACTION=IDS:Block<br />
© Copyright 2010 <strong>Trend</strong> <strong>Micro</strong> Inc. www.trendmicro.com<br />
All rights reserved. - 91 -