DefensePro User Guide
Real-Time Security Reporting
282
Document ID: RDWR-DP-V0602_UG1201
Attack Info
The attack information comprises the following parameters:
•
Packet Size Anomaly Region—Displays the statistical region of the
attack packets. The formula for the packet-size baseline for a
policy is
{(AnomalyBandwidth/AnomalyPPS)/(NormalBandwidth/NormalPPS)
}
Values:
—
Large Packets—The attack packets are approximately 15%
larger than the normal packet-size baseline for the policy.
—
Normal Packets—The attack packets are within approximately
15% either side of the normal packet-size baseline for the
policy.
—
Small Packets—The attack packets are approximately 15%
smaller than the normal packet-size baseline for the policy.
•
State—The state of the protection process:
—
Footprints Analysis—Behavioral DoS Protection has detected an
attack and is currently determining an attack footprint.
—
Blocking—Behavioral DoS Protection is blocking the attack
based on the attack footprint created. Through a closed
feedback loop operation, the Behavioral DoS Protection
optimizes the footprint rule, achieving the narrowest effective
mitigation rule.
—
Non-attack—Nothing was blocked because the traffic was not
an attack—no footprint was detected or the blocking strictness
level was not met.
Sampled Data
Opens the Sampled Data dialog box, which contains a data on sampled
attack packets.
Footprint
Footprint Blocking Rule
The footprint blocking rule generated by the Behavioral DoS Protection,
which provides the narrowest effective blocking rule against the flood
attack.
Attack Statistics Table
This table displays attack traffic (Anomaly) and normal traffic information. Red indicates real-time
values identified as suspicious in the 15 seconds prior to when the attack was triggered. Black
indicates the learned normal traffic baselines. Table columns are displayed according to the
protocols: TCP (includes all flags), UDP, or ICMP.
Attack Statistics Graph
The graph displays a snapshot of the relevant traffic type for the 15-second period during which the
attack was triggered. For example, during a UDP flood, just UDP traffic is represented. The blue line
represents the normal adapted traffic baseline.
Attack Description
The description of the attack from the Attack Descriptions file, if it is uploaded on the APSolute
Vision server.
Parameter
Description
Summary of Contents for DefensePro 6.02
Page 1: ...DefensePro User Guide Software Version 6 02 Document ID RDWR DP V0602_UG1201 January 2012 ...
Page 2: ...DefensePro User Guide 2 Document ID RDWR DP V0602_UG1201 ...
Page 20: ...DefensePro User Guide 20 Document ID RDWR DP V0602_UG1201 ...
Page 28: ...DefensePro User Guide Table of Contents 28 Document ID RDWR DP V0602_UG1201 ...
Page 116: ...DefensePro User Guide Device Network Configuration 116 Document ID RDWR DP V0602_UG1201 ...
Page 302: ...DefensePro User Guide Real Time Security Reporting 302 Document ID RDWR DP V0602_UG1201 ...
Page 308: ...DefensePro User Guide Administering DefensePro 308 Document ID RDWR DP V0602_UG1201 ...
Page 324: ...DefensePro User Guide Troubleshooting 324 Document ID RDWR DP V0602_UG1201 ...
