TMS zl Management and Configuration Guide ST.1.0.090213

4-88
Firewall
Attack Checking
Attack Checking
The TMS zl Module automatically detects and blocks specific known
attacks. It monitors TCP handshakes and drops packets with flags that signal
known attacks.
The TMS zl Module firewall checks for these attacks by default:
■ IP spoofing
■ Ping of death
■ Land attacks
■ IP reassembly attacks
Note You cannot prevent the firewall from dropping packets that display the signs
of these attacks.
Additionally, you can enable and disable certain optional checks, including
those for the following attacks:
■ ICMP replay
■ ICMP error messages
■ SYN flooding
■ Source routing
■ WinNuke
■ Sequence number prediction
■ Sequence number out of range
■ Pre-connection ACK
ProCurve periodically updates the TMS zl Module software to check for and
block new attacks. For more information about downloading new software
and upgrading it on your TMS zl Module, see “Updating the Module Soft-
ware” on page 2-77 or “Updating the Module Software” in Chapter 3: “Initial
Setup in Monitor Mode.”