The
OfficeScan firewall also includes
an Intrusion Detection System (IDS). When enabled, IDS can help
identify patterns in network packets that may indicate an attack
on the
OfficeScan client. The
OfficeScan firewall can help prevent
the following well-known intrusions:
-
Too Big Fragment:
A
Denial of Service attack where a hacker directs an oversized TCP/UDP
packet at a target computer. This can cause the computer's buffer
to overflow, which can freeze or reboot the computer.
-
Ping of Death:
A
Denial of Service attack where a hacker directs an oversized ICMP/ICMPv6
packet at a target computer. This can cause the computer's buffer
to overflow, which can freeze or reboot the computer.
-
Conflicted ARP:
A
type of attack where a hacker sends an Address Resolution Protocol
(ARP) request with the same source and destination IP address to
a computer. The target computer continually sends an ARP response
(its MAC address) to itself, causing it to freeze or crash.
-
SYN Flood:
A
Denial of Service attack where a program sends multiple TCP synchronization
(SYN) packets to a computer, causing the computer to continually
send synchronization acknowledgment (SYN/ACK) responses. This can
exhaust computer memory and eventually crash the computer.
-
Overlapping Fragment:
Similar to a Teardrop attack, this Denial of
Service attack sends overlapping TCP fragments to a computer. This
overwrites the header information in the first TCP fragment and
may pass through a firewall. The firewall may then allow subsequent
fragments with malicious code to pass through to the target computer.
-
Teardrop:
Similar
to an overlapping fragment attack, this Denial of Service attack
deals with IP fragments. A confusing offset value in the second
or later IP fragment can cause the receiving computer’s operating
system to crash when attempting to reassemble the fragments.
-
Tiny Fragment Attack:
A type of attack where a small TCP fragment size forces
the first TCP packet header information into the next fragment. This
can cause routers that filter traffic to ignore the subsequent fragments,
which may contain malicious data.
-
Fragmented IGMP:
A
Denial of Service attack that sends fragmented IGMP packets to a
target computer, which cannot properly process the IGMP packets.
This can freeze or slow down the computer.
-
LAND Attack:
A
type of attack that sends IP synchronization (SYN) packets with
the same source and destination address to a computer, causing the
computer to send the synchronization acknowledgment (SYN/ACK) response
to itself. This can freeze or slow down the computer.
