ZyXEL Communications 5 Series - Manual (Page 497)

ZyWALL 5/35/70 Series User’s Guide
Chapter 29 Reports 497
The following table describes the labels in this screen.
The statistics display as follows when you display the top entries by source.
Table 159 REPORTS > THREAT REPORTS > IDP
LABEL DESCRIPTION
Collect Statistics Select this check box to have the ZyWALL collect IDP statistics.
The collection starting time displays after you click Apply. All of the statistics in this
screen are for the time period starting at the time displayed here. The format is year,
month, day and hour, minute, second. All of the statistics are erased if you restart
the ZyWALL or click the Flush button. Collecting starts over and a new collection
start time displays.
Total Sessions
Scanned This field displays the number of sessions that the ZyWALL has checked for intrusion
characteristics.
Total Sessions
Dropped The ZyWALL can detect and drop malicious sessions from network traffic. This field
displays the number of sessions that the ZyWALL has dropped.
Total Sessions
Reset The ZyWALL can detect and reset suspicious network traffic sessions. This field
displays the number of sessions that the ZyWALL has reset.
Total Packets
Dropped The ZyWALL can detect and drop malicious packets from network traffic. This field
displays the number of packets that the ZyWALL has dropped.
Top Entry By Use this field to have the following (read-only) table display the top IDP entries by
Signature Name, Source or Destination.
Select Signature Name to list the most common signatures that the ZyWALL has
detected.
Select Source to list the source IP addresses from which the ZyWALL has detected
the most intrusion attempts.
Select Destination to list the most common destination IP addresses for intrusion
attempts that the ZyWALL has detected.
# This field displays the entry’s rank in the list of the top entries.
Signature Name This column displays when you display the entries by Signature Name. The
signature name identifies a specific intrusion pattern. Click the hyperlink for more
detailed information on the intrusion.
Type This column displays when you display the entries by Signature Name. It shows the
categories of intrusions. See
Table 75 on page 258 for more information.
Severity This column displays when you display the entries by Signature Name. It shows the
level of threat that the intrusions may pose. See
Table 76 on page 259 for more
information.
Source IP This column displays when you display the entries by Source. It shows the source IP
address of the intrusion attempts.
Destination IP This column displays when you display the entries by Destination. It shows the
destination IP address at which intrusion attempts were targeted.
Occurrences This field displays how many times the ZyWALL has detected the event described in
the entry.
Total This field displays the sum of the occurrences of the events in the entries.
Refresh Click Refresh to update the report display with additional information that the
ZyWALL may have collected while you had the screen open. The report also
refreshes automatically when you close and reopen the screen.
Flush Click Flush to discard the report data and restart collecting statistics.