The protect-socket command takes a hardware type (1U), add or "del", a protection scheme (a number), an IP address to protect, and a port to protect. From these, it generates a set of firewall rules to protect that IP and port, all added to the DATAIFPROTECT rule list.
Prolog information
Metadata
Keywords:
Any IP address sending a packet to the specified IP and port with the SYN flag but not RST or ACK is added to the apprules list.
For any IP address in the apprules list that sends:
Ten packets with the SYN flag, but without RST or ACK to the specified IP and port in one second during the TTL of the previous packet sent, drop the packet.
Five packets with the SYN flag, but without RST or ACK to the specified IP and port in one second during the TTL of the previous packet sent, reject the packet. Send an ICMP port unreachable message.
If the protection scheme is given as 1, also follow these rules:
For any IP address that sends twenty packets in state ESTABLISHED to the specified IP and port in one second, drop the packet.
Keep a record of any IP address that sends a packet in the ESTABLISHED state to the specified IP and port.
For any IP address that sends three packets in the NEW state to the specified IP and port in one second, drop the packet.
Keep a record of any IP address that sends a packet in the NEW state to the specified IP and port.
