176 Detecting
Configuring sensor detection
TCP Flow Max Queued Segments
TCP Flow Max Queued Segments
regulates the number of TCP segments that are
out of order in a queue per TCP flow. If the number of out-of-order segments
exceeds this maximum, the sensor discards the flow. Out-of-order segments in a
flow usually signify a problem; either something wrong on the network, or a
denial-of-service attack.
The default is set to 64 for optimum performance and sensitivity, and does not
need to be changed under most circumstances. The minimum value is 1. If you
see an operational event indicating too many out-of-order TCP segments, you
can eliminate the message by increasing this value, at the cost of greater
memory consumption. If you decrease this value, it reduces detection
sensitivity. Consider changing it only if you have a thorough understanding of
its functionality.
TCP Global Max Queued Segments (Fast Ethernet)
TCP Global Max Queued Segments (Fast Ethernet)
regulates the number of
out-of-order TCP segments that can remain in queue globally. If the total
number of out-of-order segments exceeds the value of this parameter, the fast
Ethernet sensor reclaims the space by replacing old TCP flows and queued
segments with new out-of-order segments.
The default is set to 65,535 for optimum performance and sensitivity, and does
not need to be changed under most circumstances. The minimum value is 4,096.
Although a high number of out-of-order segments is rare, if this is usual for your
network, you can increase this value to compensate. If you see an operational
event indicating too many out-of-order TCP segments, you can eliminate the
message by increasing this value, at the cost of greater memory consumption.
Consider changing it only if you have a thorough understanding of its
functionality.
TCP Global Max Queued Segments (Gigabit)
TCP Global Max Queued Segments
regulates the number of out-of-order TCP
segments that can remain in queue globally. If the total number of out-of-order
segments exceeds the value of this parameter, the gigabit sensor reclaims the
space by replacing old TCP flows and queued segments with new out-of-order
segments.
The default for
TCP Global Max Queued Segments (Gigabit)
is set to 131,072 for
optimum performance and sensitivity, and does not need to be changed under
most circumstances. The minimum value is 4,096. Although a high number of
out-of-order segments is rare, if this is usual for your network, you can increase
this value to compensate. If you see an operational event indicating too many
Summary of Contents for 10521146 - Network Security 7120
Page 1: ...Symantec Network Security Administration Guide...
Page 12: ...12 Contents Index...
Page 14: ...14...
Page 70: ...70...
Page 110: ...110 Populating the topology database Adding nodes and objects...
Page 158: ...158 Responding Managing flow alert rules...
Page 188: ...188...
Page 242: ...242 Reporting Playing recorded traffic...
Page 268: ...268 Managing log files Exporting data...
Page 316: ...316 Advanced configuration Configuring advanced parameters...
Page 318: ...318...
Page 338: ...338 SQL reference Using MySQL tables...
Page 366: ...366 Glossary...
Page 392: ...392 Index...
