The firewall also
includes an Intrusion Detection System (IDS). When enabled, IDS can help identify
patterns in
network packets that may indicate an attack on the
endpoint. The firewall can help prevent the following well-known intrusions:
-
Too Big Fragment:
A Denial of Service attack
where a hacker directs an oversized TCP/UDP packet at a target
endpoint. This can cause the
endpoint's buffer to overflow, which can freeze
or reboot the
endpoint.
-
Ping of Death:
A Denial of Service attack where
a hacker directs an oversized ICMP/ICMPv6 packet at a target
endpoint. This can cause the
endpoint's buffer to
overflow, which can freeze or reboot the
endpoint.
-
Conflicted ARP:
A type of attack where a hacker
sends an Address Resolution Protocol (ARP) request with the same source and destination
IP address
to a target
endpoint. The
target
endpoint
continually sends an ARP response (its MAC address) to itself, causing it to freeze
or crash.
-
SYN Flood:
A Denial of Service attack where a
program sends multiple TCP synchronization (SYN) packets to a target
endpoint, causing the
endpoint to continually send
synchronization acknowledgment (SYN/ACK) responses. This can exhaust
endpoint memory and
eventually crash the
endpoint.
-
Overlapping Fragment:
Similar to a
Teardrop attack, this Denial of Service attack sends overlapping TCP fragments to
a target
endpoint. This overwrites the
header information in the first TCP fragment and may pass through a firewall. The
firewall may then
allow subsequent fragments with malicious code to pass through to the target
endpoint.
-
Teardrop:
Similar to an overlapping fragment attack,
this Denial of Service attack deals with IP fragments. A confusing offset value in
the second or
later IP fragment can cause the receiving
endpoint’s operating system to crash when attempting to reassemble the
fragments.
-
Tiny Fragment Attack:
A type of attack where a small TCP fragment size forces
the first TCP packet header information into the next fragment. This
can cause routers that filter traffic to ignore the subsequent fragments,
which may contain malicious data.
-
Fragmented IGMP:
A Denial of Service attack
that sends fragmented IGMP packets to a target
endpoint, which cannot properly process the IGMP packets. This can freeze or
slow down the
endpoint.
-
LAND Attack:
A type of attack that sends IP
synchronization (SYN) packets with the same source and destination address to a target
endpoint, causing the
endpoint to send the
synchronization acknowledgment (SYN/ACK) response to itself. This can freeze or slow
down the
endpoint.