ZyXEL VMG1312-B10A VMG1312-B10A-EU01V1F Ficha De Dados

Chapter 15 Firewall

VMG1312-B10A User’s Guide

A SYN attack floods a targeted system with a series of SYN packets. Each packet causes the 
targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that 
follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on a backlog queue. SYN-
ACKs are moved off the queue only when an ACK comes back or when an internal timer terminates 
the three-way handshake. Once the queue is full, the system will ignore all incoming SYN requests, 
making the system unavailable for legitimate users.

Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the 
Internet. Their goal is not to steal information, but to disable a device or network so users no longer 
have access to network resources. The ZyXEL Device is pre-configured to automatically detect and 
thwart all known DoS attacks.

A DDoS attack is one in which multiple compromised systems attack a single target, thereby 
causing denial of service for users of the targeted system.

In a LAND attack, hackers flood SYN packets into the network with a spoofed source IP address of 
the target system. This makes it appear as if the host computer sent the packets to itself, making 
the system unavailable while the target system tries to respond to itself.

Ping of Death uses a "ping" utility to create and send an IP packet that exceeds the maximum 
65,536 bytes of data allowed by the IP specification. This may cause systems to crash, hang or 
reboot.

Stateful Packet Inspection (SPI) tracks each connection crossing the firewall and makes sure it is 
valid. Filtering decisions are based not only on rules but also context. For example, traffic from the 
WAN may only be allowed to cross the firewall in response to a request from the LAN.