TMS zl Management and Configuration Guide ST.1.0.090213

6-19
Intrusion Detection and Prevention
Threat Detection and Prevention
If the port is unfiltered, the host returns an RST packet.
If you are operating the TMS zl Module in routing mode, go to Firewall > Settings
> Attack Settings and enable the Pre-Connection ACK check box. The TMS zl
Module will send an RST packet for all unsolicited ACK packets, which will
create the illusion that all ports are unfiltered. (Also see “Pre-Connection ACK”
in Chapter 4: “Firewall.”)
UDP Scan
In this scan, the attacker attempts to discover which UDP ports on a host are
open and/or filtered by sending a UDP packet to a particular port.
Figure 6-10. UDP Scan, Closed Port
If the port is closed, the host returns an ICMP Port Unreachable packet.
Figure 6-11. UDP Scan, Port Open and Filtered
If the port is open and filtered, the host does not return a packet.