ZyXEL Communications P-870HW-I User Manual

P-870HW-I1 User’s Guide

150

Chapter 11 Firewalls

In general, services are consist of two parts. First, each service has one or two IP protocol 
types (for example, TCP, UDP, or TCP/UDP). Second, each service has one or more port 
numbers. Together, these parts define the service. See 

 for examples of 

services.

For DoS attacks, the ZyXEL Device uses thresholds to determine when to drop sessions that 
do not become fully established. These thresholds apply globally to all sessions.

You can use the default threshold values, or you can change them to values more suitable to 
your security requirements.

Tune these parameters when something is not working and after you have checked the firewall 
counters. These default values should work fine for most small offices. Factors influencing 
choices for threshold values are:

• The maximum number of opened sessions.
• The minimum capacity of server backlog in your LAN network.
• The CPU power of servers in your LAN network.
• Network bandwidth. 
• Type of traffic for certain servers.

If your network is slower than average for any of these factors (especially if you have servers 
that are slow or handle many tasks and are often busy), then the default values should be 
reduced.

You should make any changes to the threshold values before you continue configuring 
firewall rules. 

An unusually high number of half-open sessions (either an absolute number or measured as 
the arrival rate) could indicate that a Denial of Service attack is occurring. For TCP, "half-
open" means that the session has not reached the established state-the TCP three-way 
handshake has not yet been completed. For UDP, "half-open" means that the firewall has 
detected no return traffic.

The ZyXEL Device measures both the total number of existing half-open sessions and the rate 
of session establishment attempts. Both TCP and UDP half-open sessions are counted in the 
total number and rate measurements. Measurements are made once a minute.