ZyXEL p-660h-61 用户指南
Prestige 660H Series User’s Guide
Firewalls
10-3
10.4 Denial of Service
Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the Internet.
Their goal is not to steal information, but to disable a device or network so users no longer have access
to network resources. The Prestige is pre-configured to automatically detect and thwart all known DoS
attacks.
Their goal is not to steal information, but to disable a device or network so users no longer have access
to network resources. The Prestige is pre-configured to automatically detect and thwart all known DoS
attacks.
10.4.1 Basics
Computers share information over the Internet using a common language called TCP/IP. TCP/IP, in
turn, is a set of application protocols that perform specific functions. An “extension number”, called
the "TCP port" or "UDP port" identifies these protocols, such as HTTP (Web), FTP (File Transfer
Protocol), POP3 (E-mail), etc. For example, Web traffic by default uses TCP port 80.
turn, is a set of application protocols that perform specific functions. An “extension number”, called
the "TCP port" or "UDP port" identifies these protocols, such as HTTP (Web), FTP (File Transfer
Protocol), POP3 (E-mail), etc. For example, Web traffic by default uses TCP port 80.
When computers communicate on the Internet, they are using the client/server model, where the server
"listens" on a specific TCP/UDP port for information requests from remote client computers on the
network. For example, a Web server typically listens on port 80. Please note that while a computer
may be intended for use over a single port, such as Web on port 80, other ports are also active. If the
person configuring or managing the computer is not careful, a hacker could attack it over an
unprotected port.
"listens" on a specific TCP/UDP port for information requests from remote client computers on the
network. For example, a Web server typically listens on port 80. Please note that while a computer
may be intended for use over a single port, such as Web on port 80, other ports are also active. If the
person configuring or managing the computer is not careful, a hacker could attack it over an
unprotected port.
Some of the most common IP ports are:
Table 10-1 Common IP Ports
21 FTP
53 DNS
23 Telnet
80 HTTP
25 SMTP
110
POP3
10.4.2 Types of DoS Attacks
There are four types of DoS attacks:
1. Those that exploit bugs in a TCP/IP implementation.
2. Those that exploit weaknesses in the TCP/IP specification.
3. Brute-force attacks that flood a network with useless data.
4. IP
Spoofing.
1. "Ping of Death" and "Teardrop" attacks exploit bugs in the TCP/IP implementations of various
computer and host systems.
♦
Ping of Death uses a "ping" utility to create an IP packet that exceeds the maximum 65,536
bytes of data allowed by the IP specification. The oversize packet is then sent to an
unsuspecting system. Systems may crash, hang or reboot.
bytes of data allowed by the IP specification. The oversize packet is then sent to an
unsuspecting system. Systems may crash, hang or reboot.
♦
Teardrop attack exploits weaknesses in the re-assembly of IP packet fragments. As data is
transmitted through a network, IP packets are often broken up into smaller chunks. Each
fragment looks like the original IP packet except that it contains an offset field that says, for
instance, "This fragment is carrying bytes 200 through 400 of the original (non fragmented) IP
packet." The Teardrop program creates a series of IP fragments with overlapping offset fields.
When these fragments are reassembled at the destination, some systems will crash, hang, or
reboot.
transmitted through a network, IP packets are often broken up into smaller chunks. Each
fragment looks like the original IP packet except that it contains an offset field that says, for
instance, "This fragment is carrying bytes 200 through 400 of the original (non fragmented) IP
packet." The Teardrop program creates a series of IP fragments with overlapping offset fields.
When these fragments are reassembled at the destination, some systems will crash, hang, or
reboot.