ZyXEL g-2000 plusv2 Guia Do Utilizador

ZyXEL G-2000 Plus v2 User’s Guide

Chapter 10 Firewalls

139

Figure 53   Smurf Attack

ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types 
trigger an alert:

Traceroute is a utility used to determine the path a packet takes between two endpoints. 
Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute 
the firewall gaining knowledge of the network topology inside the firewall.

Often, many DoS attacks also employ a technique known as "IP Spoofing" as part of their 
attack. IP Spoofing may be used to break into systems, to hide the hacker's identity, or to 
magnify the effect of the DoS attack. IP Spoofing is a technique used to gain unauthorized 
access to computers by tricking a router or firewall into thinking that the communications are 
coming from within the trusted network. To engage in IP spoofing, a hacker must modify the 
packet headers so that it appears that the packets originate from a trusted host and should be 
allowed through the router or firewall. The ZyXEL device blocks all IP Spoofing attempts.

Table 48   ICMP Commands That Trigger Alerts

5

REDIRECT

13

TIMESTAMP_REQUEST

14

TIMESTAMP_REPLY

17

ADDRESS_MASK_REQUEST

18

ADDRESS_MASK_REPLY