Firewall Settings : Firewall Settings > Flood Protection
Traffic Statistics
The Firewall > Flood Protection page provides the following traffic statistics:
•
TCP Traffic Statistics
•
UDP Traffic Statistics
•
ICMP Traffic Statistics
TCP Traffic Statistics
The TCP Traffic Statistics table provides statistics on the following:
•
Connections Opened – Incremented when a TCP connection initiator sends a SYN, or a TCP connection responder receives a SYN.
•
Connections Closed – Incremented when a TCP connection is closed when both the initiator and the responder have sent a FIN and received an ACK.
•
Connections Refused – Incremented when a RST is encountered, and the responder is in a SYN_RCVD state.
•
Connections Aborted – Incremented when a RST is encountered, and the responder is in some state other than SYN_RCVD.
•
Total TCP Packets – Incremented with every processed TCP packet.
•
Validated Packets Passed – Incremented under the following conditions:
•
When a TCP packet passes checksum validation (while TCP checksum validation is enabled).
•
When a valid SYN packet is encountered (while SYN Flood protection is enabled).
•
When a SYN Cookie is successfully validated on a packet with the ACK flag set (while SYN Flood protection is enabled).
•
Malformed Packets Dropped - Incremented under the following conditions:
•
When TCP checksum fails validation (while TCP checksum validation is enabled).
•
When the TCP SACK Permitted (Selective Acknowledgement, see RFC1072) option is encountered, but the calculated option length is incorrect.
•
When the TCP MSS (Maximum Segment Size) option is encountered, but the calculated option length is incorrect.
•
When the TCP SACK option data is calculated to be either less than the minimum of 6 bytes, or modulo incongruent to the block size of 4 bytes.
•
When the TCP option length is determined to be invalid.
•
When the TCP header length is calculated to be less than the minimum of 20 bytes.
•
When the TCP header length is calculated to be greater than the packet’s data length.
•
Invalid Flag Packets Dropped - Incremented under the following conditions:
•
When a non-SYN packet is received that cannot be located in the connection-cache (while SYN Flood protection is disabled).
•
When a packet with flags other than SYN, RST+ACK or SYN+ACK is received during session establishment (while SYN Flood protection is enabled).
•
TCP XMAS Scan will be logged if the packet has FIN, URG, and PSH flags set.
•
TCP FIN Scan will be logged if the packet has the FIN flag set.
•
TCP Null Scan will be logged if the packet has no flags set.
•
When a new TCP connection initiation is attempted with something other than just the SYN flag set.
•
When a packet with the SYN flag set is received within an established TCP session.
•
When a packet without the ACK flag set is received within an established TCP session.
•
Invalid Sequence Packets Dropped – Incremented under the following conditions:
•
When a packet within an established connection is received where the sequence number is less than the connection’s oldest unacknowledged sequence.
•
When a packet within an established connection is received where the sequence number is greater than the connection’s oldest unacknowledged sequence + the connection’s last advertised window size.
•
Invalid Acknowledgement Packets Dropped –Incremented under the following conditions:
•
When a packet is received with the ACK flag set, and with neither the RST or SYN flags set, but the SYN Cookie is determined to be invalid (while SYN Flood protection is enabled).
•
When a packet’s ACK value (adjusted by the sequence number randomization offset) is less than the connection’s oldest unacknowledged sequence number.
•
When a packet’s ACK value (adjusted by the sequence number randomization offset) is greater than the connection’s next expected sequence number.
UDP Traffic Statistics
The UDP Traffic Statistics table provides statistics on the following:
•
Connections Opened
•
Connections Closed
•
Total UDP Packets – Incremented with every processed UDP packet.
•
Validated Packets Passed – Incremented under the following conditions:
•
When a UDP packet passes checksum validation (while UDP checksum validation is enabled).
•
Malformed Packets Dropped - Incremented under the following conditions:
•
When UDP checksum fails validation (while UDP checksum validation is enabled).
•
When the UDP header length is calculated to be greater than the packet’s data length.
•
UDP Floods In Progress – The number of individual forwarding devices that are currently exceeding the UDP Flood Attack Threshold.
•
Total UDP Floods Detected – The total number of events in which a forwarding device has exceeded the UDP Flood Attack Threshold.
•
Total UDP Flood Packets Rejected – The total number of packets dropped because of UDP Flood Attack detection.
ICMP Traffic Statistics
The ICMP Traffic Statistics table provides the same categories of information as the UDP Traffic Statistics , except for ICMP Flood Attacks instead of UDP Flood Attacks.