Draytek 2900 - Manual (Page 80)

Vigor2900 Series User’s Guide 74
D D e e n n i i a a l l o o f f S S e e r r v v i i c c e e ( ( D D o o S S ) ) D D e e f f e e n n s s e e
The DoS Defense functionality helps you to detect and mitigate the DoS attack. The attacks
are usually categorized into two types, the flooding-type attacks and the vulnerability attacks.
The flooding-type attacks will attempt to exhaust all your system's resource while the
vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the
protocol or operation system.
The DoS Defense function enables the Vigor router to inspect every packet based on the attack
signature database. Any malicious packet that might duplicate itself to paralyze the host in the
secure LAN will be strictly blocked and a Syslog message will be sent as warning, if you set up
Syslog server.
Also the Vigor router monitors the traffic. Any abnormal traffic flow violating the pre-defined
parameter, such as the number of thresholds, is identified as an attack and the Vigor router will
activate its defense mechanism to mitigate in a real-time manner.
The below shows the attack types that DoS/DDoS defense function can detect:
1. SYN flood attack
2. UDP flood attack
3. ICMP flood attack
4. TCP Flag scan
5. Trace route
6. IP options
7. Unknown protocol
8. Land attack 9. Smurf attack
10. SYN fragment
11. ICMP fragment
12. Tear drop attack
13. Fraggle attack
14. Ping of Death attack
15. TCP/UDP port scan
U U R R L L C C o o n n t t e e n n t t F F i i l l t t e e r r
To provide an appropriate cyberspace to users, Vigor router equips with URL Content Filter
not only to limit illegal traffic from/to the inappropriate web sites but also prohibit other web
feature where malicious code may conceal.
Once a user type in or click on an URL with objectionable keywords, URL keyword blocking
facility will decline the HTTP request to that web page thus can limit user’s access to the
website. You may imagine URL Content Filter as a well-trained convenience-store clerk who
won’t sell adult magazines to teenagers. At office, URL Content Filter can also provide a
job-related only environment hence to increase the employee work efficiency. How can URL
Content Filter work better than traditional firewall in the field of filtering? Because it checks
the URL strings or some of HTTP data hiding in the payload of TCP packets while legacy
firewall inspects packets based on the fields of TCP/IP headers only.
On the other hand, Vigor router can prevent user from accidentally downloading malicious
codes from web pages. It’s very common that malicious codes conceal in the executable objects,
such as ActiveX, Java Applet, compressed files, and other executable files. Once downloading
these types of files from websites, you may risk bringing threat to your system. For example, an
ActiveX control object is usually used for providing interactive web feature. If malicious code
hides inside, it may occupy user’s system.