Default Packet Handling

The WatchGuard Firebox System provides default packet-handling options to automatically block hosts that originate probes and attacks. Logging options help you identify sites that exhibit suspicious behavior such as spoofing. You can use the information gathered to manually and permanently block an offending site. In addition, you can block ports (by port number) to protect ports with known vulnerabilities from any incoming traffic.

The Firebox System examines and handles packets according to default packet-handling options that you set. The firewall examines the source of the packet and its intended destination by IP address and port number. It also watches for patterns in successive packets that indicate unauthorized attempts to access the network.

The default packet-handling configuration determines whether and how the firewall handles incoming communications that appear to be attacks on a network. Packet handling can:

Reject potentially threatening packets
Automatically block all communication from a source site
Add an event to the log
Send notification of potential security threats

Related topics:

Blocking spoofing attacks

Blocking port space and address space attacks

Stopping IP options attacks

Stopping SYN Flood attacks

Return to Top