The default configuration of the Firebox blocks network scans. To Protect Against Port Scan and IP Address Scans You cannot disable these features for specified IP addresses, specified Firebox interfaces, or different time periods. When the Block Port Scan, Block IP Scan or Auto-block source IP of unhandled external packets check boxes are selected, all inbound traffic is examined by the Firebox. If the number of packets sent to different IP addresses or destination ports in one second is larger than the number you select, the source IP address is added to the Blocked Sites list. The addresses can include the primary IP addresses and any secondary IP addresses configured on the interface. To identify a port scan, your Firebox counts the number of packets sent from one IP address to any Firebox interface IP address. How the Firebox Identifies Network ScansĪn IP address space scan is identified when a computer sends a specified number of packets to different IP addresses assigned to a Firebox interface. IP address scans examine a network to see which network devices are on that network.įor more information about ports, see About Ports. Port scans examine a computer to find the services that it uses. An IP scan is TCP or UDP traffic that is sent to a range of network addresses. These ports can be in sequence or random, from 0 to 65535. A port scan is TCP or UDP traffic that is sent to a range of ports. Attackers frequently look for open ports as starting points to launch network attacks.
0 Comments
Leave a Reply. |