WSM User Guide - WatchGuard Technologies

Using Default Packet Handling Options2 Select the check box for the traffic patterns you want to prevent, as explained in the sections thatfollow. The default configuration sends a log message when one of these events occur. To configurean SNMP trap or notification for default packet handling, click Logging.Spoofing attacksOne procedure that attackers use to get access to your network is to make an “electronic false identity.”With this “IP spoofing” procedure, the attacker sends a TCP/IP packet that uses a different IP addressthan the host that first sent it.With IP spoofing enabled, the Firebox® checks to make sure that the source IP address of a packet is froma network on that interface.To protect against spoofing attacks, select the Drop Spoofing Attacks check box from the DefaultPacket Handling dialog box.IP source route attacksAttackers use IP source route attacks to send an IP packet to find the route that the packet uses to gothrough the network. The attacker can then see the response to the packets and get information aboutthe operating system of the target computer or network.To protect against IP source route attacks, select the Drop IP Source Route check box from the DefaultPacket Handling dialog box.“Ping of death” attacks“Ping of death” is a denial of service (DoS) attack. It is caused by an attacker that sends an IP packet thatis larger than the 65,535 bytes allowed by the IP protocol. This causes some operating systems to crashor restart.To protect against ping of death attacks, the Drop Ping of Death feature is always enabled. You cannotdisable this feature.136 WatchGuard System Manager