https://community.checkpoint.com/t5/General-Topics/Firewall-Behaviour-Pattern/m-p/119064#M22171 <P>Hi Mates,</P> <P>I have a customer asking : <BR />1. Behavior pattern of CP, if it receives too many packets from same source for SYNC ACK.<BR />2. Is there any module\settings or configuration which does this kind of inspection in checkpoint?<BR />3. If such behavior is not carried out by CP, is there any means where we can cross check above query.<BR />Please advise!</P> Fri, 21 May 2021 14:06:00 GMT vegullas514 2021-05-21T14:06:00Z https://community.checkpoint.com/t5/General-Topics/Firewall-Behaviour-Pattern/m-p/119064#M22171 <P>Hi Mates,</P> <P>I have a customer asking : <BR />1. Behavior pattern of CP, if it receives too many packets from same source for SYNC ACK.<BR />2. Is there any module\settings or configuration which does this kind of inspection in checkpoint?<BR />3. If such behavior is not carried out by CP, is there any means where we can cross check above query.<BR />Please advise!</P> Fri, 21 May 2021 14:06:00 GMT https://community.checkpoint.com/t5/General-Topics/Firewall-Behaviour-Pattern/m-p/119064#M22171 vegullas514 2021-05-21T14:06:00Z https://community.checkpoint.com/t5/General-Topics/Firewall-Behaviour-Pattern/m-p/119065#M22172 <P>Your question needs a lot more content to give a precise answer, but it&nbsp;sounds like the kind of stuff that’s generally checked for as part of the Inspection Settings in the firewall.</P> Fri, 21 May 2021 14:16:42 GMT https://community.checkpoint.com/t5/General-Topics/Firewall-Behaviour-Pattern/m-p/119065#M22172 PhoneBoy 2021-05-21T14:16:42Z https://community.checkpoint.com/t5/General-Topics/Firewall-Behaviour-Pattern/m-p/119081#M22177 <P>Would also be worth looking at SYN Defender and connection quotas, which I think are both under IPS currently.</P> Fri, 21 May 2021 16:12:48 GMT https://community.checkpoint.com/t5/General-Topics/Firewall-Behaviour-Pattern/m-p/119081#M22177 Bob_Zimmerman 2021-05-21T16:12:48Z