The Attack Detection Plug-In

About Attack Detection

The Attack Detection plug-in informs you of a possible attack on your computer from the Internet or the network your computer is connected to.

The Outpost Attack Detection Plug-in consists of two parts:

  • Outpost Scanning Detection module.

  • Outpost Attack Detection module.

The Outpost Attack Detection module detects and blocks the following attacks-also called exploits or Denial Of Service (DoS) attacks: Teardrop, Nestea, Iceping, Moyari13, Winnuke, Nuke, FRAG_ICMP Class (Jol12, Targa13 and other), FRAG_IGMP Class (IGMPSYN and other), SHORT_FRAGMENTS Class, MY_ADDRESS Class (Snork and others), Rst, 1234, Fawx, Fawx2, Kox, Tidcmp, Rfposion, Rfparalyse and Win95handles.

The Outpost Attack Detection module can also detect and neutralize simple distributed DoS attacks.

The Outpost Scanning Detection module can detect simple TCP and UDP port scanning as well as the following types of stealth scanning: Syn, Fin, Xmas, Null, Udp. If Outpost detects a suspicious packet, it displays the "Connection request" message in its log file. "Port Scanning" is another intrusion indicator that is detected if several suspicious packets are received from one remote host within a specified time interval.

The following topics describe how to set-up the Attack Detection plug-in:

Viewing the Attack Detection log

Setting the Alarm Level

Blocking intruders

Protecting from simple DoS Attacks

Note

For more information about fine-tuning this plug-in, read the protect.lst file in Outpost Firewall's install folder.


Viewing the Attack Detection Log

To view the Attack Detection log:

  1. Right-click on the Outpost Firewall icon in the system tray to get the context menu.

  2. Select Show Outpost Firewall

  3. Highlight Attack Detection in the Plug-Ins tree.

  4. Press the Show Detailed Log button on the plug-in Information Panel.

  5. Outpost Log Viewer will be run displaying the log for the Attack Detection plug-in log.

For more information about Outpost log system please read The Outpost Log System chapter.

Related Topics

About Attack Detection

Setting the Alarm Level

Blocking intruders

Protecting from simple DoS Attacks


Setting the Alarm Level

The Alarm Level determines the number of suspicious packets detected before Outpost reports "Port Scan Detected".

To set the alarm level:

  1. Select Options

  2. Select Plug-Ins

  3. Highlight Attack Detection

  4. Click Settings

  5. To set the alert level move the slider to

    • Maximum—a "Port Scanned" alert is displayed even if a single scanning of your port is detected.

    • Normal—a "Port Scanned" alert is displayed if several ports are scanned or if a specific port is scanned that Outpost Firewall recognizes as one that is commonly used in attacks.

    • Minimum—a "Port Scanned" alert is displayed if a multiple attack is definitely detected.

Notes

  • You can quickly access the plug-in's properties by right clicking on its name in the Left Panel of Outpost Firewall's main window.

  • To receive visual alerts about detected attacks, select the Report detected attacks option.

Related Topics

About Attack Detection

Viewing the Attack Detection log

Blocking intruders

Protecting from simple DoS Attacks


Blocking Intruders

After Outpost detects an attack and displays the "Port Scan Detected" message in the logs, it can be configured to avoid possible future attacks.

  1. Select Options

  2. Select Plug-Ins

  3. Highlight Attack Detection

  4. Click Settings

  5. Specify the steps Outpost Firewall is to follow if an attack on your computer is detected:

    • Block the intruder IP for, if selected, blocks all network exchanges from the computer attacking yours for the number of minutes you set (60 minutes is the default).

    • Also block intruder subnet, if selected, blocks all network exchanges from the entire subnet to which the intruder belongs.

Note

You can quickly access the plug-in's properties by right clicking on its name in the Left Panel of Outpost Firewall's main window.

Related Topics

About Attack Detection

Viewing the Attack Detection log

Setting the Alarm Level

Protecting from simple DoS Attacks


Protecting from Simple DoS Attacks

Sometimes crackers send large numbers of connection request packets to an open port using many remote hosts or IP spoofing techniques. To protect yourself from this kind of DoS attack:

  1. Select Options

  2. Select Plug-Ins

  3. Highlight Attack Detection

  4. Click Settings

  5. Check Block local port if DoS attack detected

Note

You can quickly access the plug-in's properties by right clicking on its name in the Left Panel of Outpost Firewall's main window.

Related Topics

About Attack Detection

Viewing the Attack Detection log

Setting the Alarm Level

Blocking intruders


.topic 0x808b0001
Applies and saves any changes you have made, and then closes this dialog box.

.topic 0x808b0002
The Cancel button closes this dialog box without saving any changes you have made. The Close button closes this dialog box and retains the changes you made.

.IDD_PROTECT (5) **********************************************************************************

.topic 0x80bd03f9
Sets the alert level to low, normal or high.

.topic 0x80bd03fa
A checkmark enables the blocking of an intruder's IP address for a period if port scanning is detected.

.topic 0x80bd0401
A checkmark enables the blocking of a local port if a DoS attack is detected.

.topic 0x80bd03fe
A checkmark enables the blocking of an intruder's subnet mask.

.topic 0x80bd03fc
An input field to enter the period an intruder's IP address is to be blocked.

.topic 0x80bd1775
Select to have plugin to display an alert message every time an attack is detected.