PLANET IM-1000 - Manual (Page 171)

Terms
The threshold sessions of anomaly flow ( per source IP)
„ When the session number ( per source IP ) has over the limitation of anomaly flow
sessions per source IP, then IM-1000 will take this kind of IP to be anomaly flow
IP and make some actions. For example, block the anomaly flow IP or send the
notification)
Anomaly Flow IP Blocking
„ IM-1000 can block the sessions of anomaly flow IP.
Notification
„ IM-1000 can notice the user and system administrator by e-mail or NetBIOS
notification as any anomaly flow occurred.
Co-Defense System
„ IM-1000 has the co-defense mechanism which can integrated the switch, so that
can enhance the enterprise network security protection.
Non-detected IP
„ System administrator can set which IP address to be the non-detected IP, it is
because some of these IP provide amount of services, so that will let IM-1000
define it to be anomaly flow IP. We can use this function to avoid the problem.