About Port Space and Address Space Probes

Attackers frequently look for open ports as starting points to launch network attacks. A port space probe is TCP or UDP traffic that is sent to a range of ports. These ports can be in sequence or random, from 0 to 65535. An address space probe is TCP or UDP traffic that is sent to a range of network addresses. Port space probes examine a computer to find the services that it uses. Address space probes examine a network to see which network devices are on that network.

For more information about ports, see About Ports.

How the XTM Device Identifies Network Probes

An address space probe is identified when a computer sends a specified number of packets to different IP addresses assigned to an XTM device interface. To identify a port space probe, your XTM device counts the number of packets sent from one IP address to any XTM device interface IP address. The addresses can include the primary IP addresses and any secondary IP addresses configured on the interface. If the number of packets sent to different IP addresses or destination ports in one second is larger than the number you select, the source IP address is added to the Blocked Sites list.

When the Block Port Space Probes and Block Address Space Probes check boxes are selected, all incoming traffic on all interfaces is examined by the XTM device. You cannot disable these features for specified IP addresses, specified XTM device interfaces, or different time periods.

To Protect Against Port Space and Address Space Probes

The default configuration of the XTM device blocks network probes. You can use Fireware XTM Web UI to change the settings for this feature, and change the maximum allowed number of address or port probes per second for each source IP address (the default value is 10).

  1. Select Firewall > Default Packet Handling.
    The Default Packet Handling page appears.

Screen shot of the Default Packet Handling page

  1. Select or clear the Block Port Space Probes and the Block Address Space Probes check boxes.
  2. Type the maximum number of address or port probes to allow per second from the same IP address. The default for each is 10 per second. This means that a source is blocked if it initiates connections to 10 different ports or hosts within one second.
  3. Click Save.

To block attackers more quickly, you can set the threshold for the maximum allowed number of address or port probes per second to a lower value. If the number is set too low, the XTM device could also deny legitimate network traffic . You are less likely to block legitimate network traffic if you use a higher number, but the XTM device must send TCP reset packets for each connection it drops. This uses bandwidth and resources on the XTM device and provides the attacker with information about your firewall.

See Also

About Default Packet Handling Options

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Knowledge Base