topic Re: scan-host sweep in General Topics

scan-host sweep

sib2017 — Wed, 14 Dec 2016 14:33:21 GMT

Hi,

Under threat detection, scan host sweep droped some traffic. And under the rules it did not show anything .

What does it mean

Thanks

Re: scan-host sweep

fozail — Thu, 15 Dec 2016 06:25:26 GMT

Hi,

Do you have a zone protection profile configured and you have configured an action for the host sweep scan?

Best Regards,

Fozail

Re: scan-host sweep

reaper — Thu, 15 Dec 2016 08:12:18 GMT

You probably have zone protection enabled

'host sweep' is a reconnaissance attack where a host 'scans' several of your ip addresses

Re: scan-host sweep

sib2017 — Sun, 18 Dec 2016 13:04:44 GMT

Hi,

what is the interval and Threshold here .

how a zone protection profile integrated with a zone ?

for example if we have zone trust,server , how we assign the profile to the zone .

What if we change from the block to alert ? .

Thanks

Re: scan-host sweep

reaper — Sun, 18 Dec 2016 19:58:10 GMT

Threshold is the number of events in the interval amount of time
So 100 hosts touched in 2 seconds for example
Zone protection is global for all traffic hitting a destination zone

If you need to be more granular, to protect a single server's resources for example, you should use a DOS policy

If you set action alert instead of block, you will simply see a log entry for each 'scan' but no action is taken

Re: scan-host sweep

fozail — Tue, 27 Dec 2016 11:58:14 GMT

Hi Reaper,

As far as I remember "Zone Protection Profile" applies on source zone not on destination zone, correct me if I am wrong.

Best Regards,

Fozail

Re: scan-host sweep

kiwi — Tue, 27 Dec 2016 14:28:33 GMT

Hi @fozail,

Zone protection profile is designed to provide broad-based protection at the ingress zone (i.e. the zone where traffic enters the firewall) and is not designed to protect a specific end host or traffic going to a particular destination zone. Use the DoS protection rulebase to match on a specific zone, interface, IP address or user.

Cheers !

-Kim.

Re: scan-host sweep

fozail — Tue, 27 Dec 2016 15:02:24 GMT

Hi Kim,

Yes, you are correct. I got confused as per other description where it is mentioned that "zone protection is for destination zone".

Thank you for the clarification.