public ARPPoisoningProtectionModule()
: base()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Name = "ARP Poisoning Protection";
m.Version = "1.2.0.1";
m.Author = "Brian W. (schizo)";
m.Description = "Protects against ARP Poisoning attacks";
m.Help = "ARP Poisoning: A local network attack that redirects communications through the attacker. This allows them see, modify, or drop your traffic. There is very little for protection against these attacks currently out on the market."
+ "\r\n\r\nHow we prevent it is by ignoring any ARP response packet that reaches the firewall that you computer didn't ask for. On top of that, we also save solicited responses so if a conflicting response is returned, we can tell an attack is happening, and the firewall attempts to tell the other computer being attacked the truth."
+ "\r\n\r\nThe module configuration is quite simple. It displays the known MAC address to IP correlations that it knows. If one of these values is incorrect, you can remove it by clicking on it, and hitting the 'Remove Entry' button. You can also clear the entire cache, if you switch networks or something like that. The Save ARP Cache check box will allow you to save or not save the values for the next time fireBwall runs. The Log Unsolicited check box lets you choose if you want to be notified of ARP Responses that your computer did not request. The Log Attacks check box lets you choose if you want to be notified of ARP Poisoning Attacks that have been detected and defeated. The Rectify Attack checkbox lets you choose if fireBwall tries to fix the attack on the other victim, this is extremely effective for simple attacks.";
m.Contact = "*****@*****.**";
MetaData = new ModuleMeta(m);
Language lang = Language.ENGLISH;
multistring.SetString(lang, "Response does not equal cache", "ARP Response from {0} for {1} does not match the ARP cache.");
multistring.SetString(lang, "Unsolicited", "Unsolicited ARP Response from {0} for {1}.");
lang = Language.CHINESE;
multistring.SetString(lang, "Response does not equal cache", "从 {0} {1} ARP 回应与 ARP 缓存不匹配。");
multistring.SetString(lang, "Unsolicited", "从 {0} {1} 未经请求的 ARP 回应。");
lang = Language.DUTCH;
multistring.SetString(lang, "Response does not equal cache", "ARP reactie van {0} {1} komt niet overeen met de ARP-cache.");
multistring.SetString(lang, "Unsolicited", "Ongevraagde ARP reactie van {0} {1}.");
lang = Language.FRENCH;
multistring.SetString(lang, "Response does not equal cache", "Réponse ARP de {0} de {1} ne correspond pas le cache ARP.");
multistring.SetString(lang, "Unsolicited", "Réponse de ARP non sollicité de {0} de {1}.");
lang = Language.GERMAN;
multistring.SetString(lang, "Response does not equal cache", "ARP-Antwort von {0} {1} entspricht nicht den ARP-Cache.");
multistring.SetString(lang, "Unsolicited", "Unaufgeforderte ARP-Antwort von {0} {1}.");
lang = Language.HEBREW;
multistring.SetString(lang, "Response does not equal cache", "תגובת ARP {0} עבור {1} אינו תואם את מטמון ARP.");
multistring.SetString(lang, "Unsolicited", "תגובת ARP שלא ביקשת מראש מ- {0} עבור {1}.");
lang = Language.ITALIAN;
multistring.SetString(lang, "Response does not equal cache", "ARP risposta da {0} per {1} non corrisponde la cache ARP.");
multistring.SetString(lang, "Unsolicited", "Risposta di ARP non richiesto da {0} per {1}.");
lang = Language.JAPANESE;
multistring.SetString(lang, "Response does not equal cache", "ARP 応答から {0} {1} の ARP キャッシュが一致しません。");
multistring.SetString(lang, "Unsolicited", "不要な ARP 応答から {0} を {1}。");
lang = Language.PORTUGUESE;
multistring.SetString(lang, "Response does not equal cache", "Resposta ARP de {0} para {1} não coincide com o cache do ARP.");
multistring.SetString(lang, "Unsolicited", "Resposta ARP não solicitadas de {0} para {1}.");
lang = Language.RUSSIAN;
multistring.SetString(lang, "Response does not equal cache", "ARP ответ от {0} {1}, не соответствует кэш ARP.");
multistring.SetString(lang, "Unsolicited", "Незапрошенные ARP ответ от {0} {1}.");
lang = Language.SPANISH;
multistring.SetString(lang, "Response does not equal cache", "Respuesta de ARP de {0} {1} no coincide con la caché ARP.");
multistring.SetString(lang, "Unsolicited", "Respuesta de ARP no solicitada de {0} {1}.");
}
/// <summary>
/// metadata
/// </summary>
private void Help()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Name = "IPGuard";
m.Author = "Bryan A.";
m.Contact = "*****@*****.**";
m.Description = "Blocks IPs from given lists.";
m.Version = "1.1.0.0";
m.Help = "IPGuard is a module that mimics the behavior of other blocklist applications such as PeerBlock, or its predecessor PeerGuardian. Given a correctly formatted list,"
+ " IPGuard can block TCP packets, both incoming and outgoing, to a wide range of IPs. The most widely distributed lists are typically those found on"
+ "www.iblocklist.com. \n\nThese lists need to be downloaded and added to your /firebwall/modules/IPGuard folder, and then enabled in the module's GUI."
+ " These lists need to be formatted in the following way: <string>:ip-ip. If you, for example, wanted to block a single IP address, it would be"
+ " required to be in the following form: firebwall:66.172.10.29-66.172.10.29";
MetaData = new ModuleMeta(m);
Language lang = Language.ENGLISH;
multistring.SetString(lang, "Blocked Outgoing", "Blocked outgoing packets from {0}");
multistring.SetString(lang, "Blocked Incoming", "Blocked incoming packets from {0}");
lang = Language.CHINESE;
multistring.SetString(lang, "Blocked Outgoing", "阻止从传出数据包 {0}");
multistring.SetString(lang, "Blocked Incoming", "被阻止传入的数据包 {0}");
lang = Language.DUTCH;
multistring.SetString(lang, "Blocked Outgoing", "De uitgaande pakketten van geblokkeerd {0}");
multistring.SetString(lang, "Blocked Incoming", "Binnenkomende pakketten van geblokkeerd {0}");
lang = Language.FRENCH;
multistring.SetString(lang, "Blocked Outgoing", "Bloqué des paquets sortants de {0}");
multistring.SetString(lang, "Blocked Incoming", "Bloque les paquets entrants de {0}");
lang = Language.GERMAN;
multistring.SetString(lang, "Blocked Outgoing", "Blockierte ausgehende Pakete aus {0}");
multistring.SetString(lang, "Blocked Incoming", "Blockiert eingehende Pakete von {0}");
lang = Language.ITALIAN;
multistring.SetString(lang, "Blocked Outgoing", "Bloccati i pacchetti in uscita dal {0}");
multistring.SetString(lang, "Blocked Incoming", "Bloccati i pacchetti in ingresso da {0}");
lang = Language.JAPANESE;
multistring.SetString(lang, "Blocked Outgoing", "発信パケットをブロック {0}");
multistring.SetString(lang, "Blocked Incoming", "着信パケットをブロック {0}");
lang = Language.PORTUGUESE;
multistring.SetString(lang, "Blocked Outgoing", "Bloqueados pacotes de saída de {0}");
multistring.SetString(lang, "Blocked Incoming", "Bloqueados pacotes de entrada da {0}");
lang = Language.RUSSIAN;
multistring.SetString(lang, "Blocked Outgoing", "Заблокированы исходящие пакеты от {0}");
multistring.SetString(lang, "Blocked Incoming", "Заблокировано входящих пакетов {0}");
lang = Language.SPANISH;
multistring.SetString(lang, "Blocked Outgoing", "Bloquea los paquetes salientes desde {0}");
multistring.SetString(lang, "Blocked Incoming", "Bloquea los paquetes entrantes de {0}");
}
/// <summary>
/// metadata
/// </summary>
private void Help()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Author = "Bryan A.";
m.Contact = "*****@*****.**";
m.Description = "Detects port scans.";
m.Help = "OVERVIEW\nPort scans typically range from troubleshooting, harmless self-inspection to a preemptive strike for a malicious attack."
+ "They provide valuable information to attackers when searching for potential avenues for exploitation. They are, also, not all"
+ " completely malicious. Many system administrators port scan themselves when attempting to diagnose issues, perform self-audits, or other various maintenance work."
+ " Scan Detector, on its default settings, only alerts the user of a potential scan. The user can then decide "
+ "whether or not to continue receiving packets from the IP address. If the user wishes to not be the arbiter of that, a \'block immediately'"
+ " option is selectable. \n\nTECHNICAL\nScan Detector logs how many ports an IP address has touched with a short window of time. An IP has its ports washed "
+ " after 30 seconds, and the IP is completely removed after 1 minute of inactivity. These numbers were chosen based on performance and nmap timings. nmap at its"
+ " most paranoid spits out one packet per 15 seconds. The number of distinct ports touched within this window is 100; this number was chosen based on nmap's "
+ "-F flag, which runs a scan in \'Fast\' mode, or scan only the top 100 ports.\n\nCLOAKED MODE\nCloaked mode is an attempt to exploit the security-through-obscurity"
+ " mechanisms behind port scanning/detecting. It is an adaptation of Jon Erickson's Shroud application in \'The Art of Exploitation\'. The objective is to "
+ "disguise real ports within a sea of false positives. If, for example, an attacker scans 2000 ports on the host system, all 2000 ports will respond as if they"
+ " are actually open. This works by merely responding to every SYN that passes by with a SYN ACK.";
m.Name = "Scan Detector";
m.Version = "0.1.0.0";
MetaData = new ModuleMeta(m);
Language lang = Language.ENGLISH;
multistring.SetString(lang, "Touched Ports", "{0} touched {1} ports with an average of {2}");
lang = Language.CHINESE;
multistring.SetString(lang, "Touched Ports", "{0} 触及 {2} 平均 {1} 端口");
lang = Language.DUTCH;
multistring.SetString(lang, "Touched Ports", "{0} aangeraakt {1} havens met een gemiddelde van {2}");
lang = Language.FRENCH;
multistring.SetString(lang, "Touched Ports", "{0} touché {1} ports avec une moyenne de {2}");
lang = Language.GERMAN;
multistring.SetString(lang, "Touched Ports", "{0} {1} Häfen mit einem Durchschnitt von {2} berührt");
lang = Language.ITALIAN;
multistring.SetString(lang, "Touched Ports", "{0} toccato {1} porti con una media di (2)");
lang = Language.JAPANESE;
multistring.SetString(lang, "Touched Ports", "{0} は、{1} のポート {2} の平均で触れた");
lang = Language.PORTUGUESE;
multistring.SetString(lang, "Touched Ports", "tocado de {0} {1} portas com uma média de {2}");
lang = Language.RUSSIAN;
multistring.SetString(lang, "Touched Ports", "коснулся {0} {1} порты с в среднем {2}");
lang = Language.SPANISH;
multistring.SetString(lang, "Touched Ports", "{0} tocado puertos {1} con un promedio de {2}");
}
public PortKnockerModule()
: base()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Name = "PortKnocker";
m.Version = "0.0.0.1";
m.Author = "Brian W.";
m.Description = "";
m.Help = "";
m.Contact = "";
MetaData = new ModuleMeta(m);
}
public PortTrapModule()
: base()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Name = "PortTrap";
m.Version = "0.0.0.1";
m.Author = "Brian W.";
m.Description = "This module will block any IP address that tries to connect to specified ports, adding it to a block list.";
m.Help = "";
m.Contact = "";
MetaData = new ModuleMeta(m);
}
// module metadata
private void Help()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Name = "IP Monitor";
m.Version = "1.0.2.0";
m.Description = "Displays varying information about network connections";
m.Contact = "*****@*****.**";
m.Author = "Bryan A. (drone)";
m.Help = "The IP Monitor module displays connections and their corresponding ports on the localhost's TCP/UDP sockets. The list is "
+ "refreshed every 5 seconds to keep up with the frequency of lost/established connections. The 'state' column of TCP connections can be one of "
+ "nine different states. They are: \n"
+ "1. LISTENING\t\tIn case of a server, waiting for a connection request form any remote client.\n"
+ "2. SYN-SENT\t\tWaiting for a remote peer to send back a SYN/ACK.\n"
+ "3. SYN-RECEIVED\t\tWaiting for a remote peer to send back an ACK.\n"
+ "4. ESTABLISHED\t\tThe port is ready to receive/send data to/from a peer.\n"
+ "5/6. FIN-WAIT-(1|2)\t\tThe client is waiting for the server's FIN.\n"
+ "7.. CLOSE-WAIT\t\tIndicates the server is sending it's own FIN.\n"
+ "8. TIME-WAIT\t\tWaiting to ensure peer received teardown ACK.\n"
+ "9. CLOSED\t\tConnection is closed.\n\n"
+ "The format of connections is IP:PORT";
MetaData = new ModuleMeta(m);
Language lang = Language.ENGLISH;
multistring.SetString(lang, "Connections Accepted", "Connections Accepted:");
multistring.SetString(lang, "Connections Initiated", "Connections Initiated:");
multistring.SetString(lang, "Cumulative Connections", "Cumulative Connections:");
multistring.SetString(lang, "Errors Received", "Errors Received:");
multistring.SetString(lang, "Failed Connection Attempts", "Failed Connection Attempts:");
multistring.SetString(lang, "Maximum Connections", "Maximum Connections:");
multistring.SetString(lang, "Reset Connections", "Reset Connections:");
multistring.SetString(lang, "Resets Sent", "Resets Sent:");
multistring.SetString(lang, "Segments Received", "Segments Received:");
multistring.SetString(lang, "Segments Resent", "Segments Resent:");
multistring.SetString(lang, "Segments Sent", "Segments Sent:");
multistring.SetString(lang, "Datagrams Received", "Datagrams Received:");
multistring.SetString(lang, "Datagrams Sent", "Datagrams Sent:");
multistring.SetString(lang, "Incoming Datagrams Discarded", "Incoming Datagrams Discarded:");
multistring.SetString(lang, "Incoming Datagrams With Errors", "Incoming Datagrams With Errors:");
}
// module metadata
private void Help()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Name = "ICMP Filter";
m.Version = "1.0.4.0";
m.Description = "Blocks ICMP packets of a given type/code";
m.Contact = "*****@*****.**";
m.Author = "Bryan A. (drone)";
m.Help = "This module can be used to block all (or particular) ICMP packets from flowing in or out of your network."
+ "ICMP packets are used to exchange error messages between networked computers, but it's also used with tools such as nmap "
+ "and nessus to gain valuable information about systems behind a gateway.\n\n"
+ "ICMP Segment Structure\n "
+ "\t|——————————————————————————————|\n"
+ "\t| BITS | 0-7 | 8-15 | 16-23 | 24-31 |\n"
+ "\t|——————————————————————————————|\n"
+ "\t| 0 | Type | Code | Checksum |\n"
+ "\t| 32 | Rest of Header |\n"
+ "\t|——————————————————————————————|\n"
+ "A full list of supported control messages can be found on the module page (View ICMP)."
+ "\n\nAs of .3.11, ICMPFilter differentiates between ICMPv4 and ICMPv6. It can block all IPv4 or all IPv6 packets, as well"
+ " as in inidividual v4/v6.\n\nThe module can also now block all ICMPv6 packets EXCEPT for NDP packets. This is because"
+ " NDP packets are required for intranet connectivity and other vital tasks.";
MetaData = new ModuleMeta(m);
Language lang = Language.ENGLISH;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 from {0} for {1} was dropped.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 from {0} for {1} was dropped.");
lang = Language.CHINESE;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 从 {0} 至 {1} 被丢弃.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 从 {0} 至 {1} 被丢弃.");
lang = Language.DUTCH;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 uit {0} voor {1} is neergezet.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 uit {0} voor {1} is neergezet.");
lang = Language.FRENCH;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 à partir de {0} pour {1} a été abandonné.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 à partir de {0} pour {1} a été abandonné.");
lang = Language.GERMAN;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 aus {0} für {1} wurde fallengelassen.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 aus {0} für {1} wurde fallengelassen.");
lang = Language.HEBREW;
// JUST KIDDING;
lang = Language.ITALIAN;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 da {0} per {1} è stato eliminato.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 da {0} per {1} è stato eliminato.");
lang = Language.JAPANESE;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 から {0} のために {1} 削除されました.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 から {0} のために {1} 削除されました.");
lang = Language.PORTUGUESE;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 a partir de {0} para {1} foi descartado.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 a partir de {0} para {1} foi descartado.");
lang = Language.RUSSIAN;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 от {0} для {1} было прекращено.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 от {0} для {1} было прекращено.");
lang = Language.SPANISH;
multistring.SetString(lang, "ICMPv6 was dropped", "ICMPv6 a partir {0} de {1} se cayo.");
multistring.SetString(lang, "ICMPv4 was dropped", "ICMPv4 a partir {0} de {1} se cayo.");
}
public MacFilterModule()
: base()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Name = "MAC Address Filter";
m.Version = "1.1.0.0";
m.Help = "Each network adapter has a MAC address. It can only be changed or faked in rare circumstances."
+ "Each packet sent over the network says the MAC its from and the MAC its to."
+ "This module allows you to control which MAC you will send or recieve data from. Similarly to the Basic Firewall, the rules are processed in order from top to bottom. You can also reorder the rules by clicking move up and move down. To add a rule, click on Add Rule, and to remove one, click Remove Rule.";
m.Description = "Blocks or allows packets based on MAC address";
m.Contact = "*****@*****.**";
m.Author = "Brian W. (schizo)";
MetaData = new ModuleMeta(m);
Language lang = Language.ENGLISH;
multistring.SetString(lang, "Add Rule", "Add Rule");
multistring.SetString(lang, "Remove Rule", "Remove Rule");
multistring.SetString(lang, "Move Up", "Move Up");
multistring.SetString(lang, "Move Down", "Move Down");
lang = Language.CHINESE;
multistring.SetString(lang, "Add Rule", "新增规则");
multistring.SetString(lang, "Remove Rule", "删除规则");
multistring.SetString(lang, "Move Up", "动起来");
multistring.SetString(lang, "Move Down", "下移");
lang = Language.DUTCH;
multistring.SetString(lang, "Add Rule", "Regel toevoegen");
multistring.SetString(lang, "Remove Rule", "Regel verwijderen");
multistring.SetString(lang, "Move Up", "Omhoog");
multistring.SetString(lang, "Move Down", "Omlaag verplaatsen");
lang = Language.FRENCH;
multistring.SetString(lang, "Add Rule", "Ajoutez la règle");
multistring.SetString(lang, "Remove Rule", "Supprimer la règle");
multistring.SetString(lang, "Move Up", "Déplacez vers le haut");
multistring.SetString(lang, "Move Down", "Déplacer vers le bas");
lang = Language.GERMAN;
multistring.SetString(lang, "Add Rule", "Regel hinzufügen");
multistring.SetString(lang, "Remove Rule", "Regel entfernen");
multistring.SetString(lang, "Move Up", "Nach oben");
multistring.SetString(lang, "Move Down", "Nach unten");
lang = Language.HEBREW;
multistring.SetString(lang, "Add Rule", "הוספת כלל");
multistring.SetString(lang, "Remove Rule", "הסרת כלל");
multistring.SetString(lang, "Move Up", "הזז למעלה");
multistring.SetString(lang, "Move Down", "הזז למטה");
lang = Language.ITALIAN;
multistring.SetString(lang, "Add Rule", "Aggiungi regola");
multistring.SetString(lang, "Remove Rule", "Rimuovere regola");
multistring.SetString(lang, "Move Up", "Spostarsi verso l'alto");
multistring.SetString(lang, "Move Down", "Spostare verso il basso");
lang = Language.JAPANESE;
multistring.SetString(lang, "Add Rule", "ルールを追加します。");
multistring.SetString(lang, "Remove Rule", "規則を削除します。");
multistring.SetString(lang, "Move Up", "上に移動します。");
multistring.SetString(lang, "Move Down", "下に移動します。");
lang = Language.PORTUGUESE;
multistring.SetString(lang, "Add Rule", "Adicionar regra");
multistring.SetString(lang, "Remove Rule", "remover Regra");
multistring.SetString(lang, "Move Up", "mover para cima");
multistring.SetString(lang, "Move Down", "mover para Baixo");
lang = Language.RUSSIAN;
multistring.SetString(lang, "Add Rule", "Добавить правило");
multistring.SetString(lang, "Remove Rule", "Удалить правило");
multistring.SetString(lang, "Move Up", "вверх");
multistring.SetString(lang, "Move Down", "спускать");
lang = Language.SPANISH;
multistring.SetString(lang, "Add Rule", "Añadir regla");
multistring.SetString(lang, "Remove Rule", "Eliminar la regla");
multistring.SetString(lang, "Move Up", "Subir");
multistring.SetString(lang, "Move Down", "Bajar");
}
// module metadata
private void Help()
{
ModuleMeta.Meta m = new ModuleMeta.Meta();
m.Name = "DDoS Mitigation";
m.Version = "1.0.1.0";
m.Description = "Mitigates DoS Attacks";
m.Contact = "*****@*****.**";
m.Author = "Bryan A. (drone)";
m.Help = "A DDoS, or a distributed denial of service, is an attack on a network in an attempt to exhaust all possible resources. The idea "
+ " is not to 'hack' passwords or steal data (although it can be used as a staging attack), but rather to cause a service to become unavailable. The theft "
+ " of availability. This module, at its current inception, assists in the mitigation of three different types of attacks.\n\n"
+ "DoS/TCP FLOOD\n\tThis general attack is characterized by an overwhelming amount of incoming TCP packets destined for arbitrary ports, or, if it"
+ " is a web server, port 80. The idea behind mitigation is to keep a count of IP's, packet counts, and packet timestamps to trace a possible source of a "
+ "DDoS. As the name would suggest, a DDoS will not be limited to a single IP, but rather be distributed over hundreds of thousands of systems. This module "
+ "attempts to take these concepts into account and premptively cease a DDoS attack. When a DDoS is detected, packets from violating IPs are added to a block list."
+ " Eventually, this module will be intelligent enough to take more decisive action when floods are detected. To test the module, disable the basic firewall module "
+ "(or temporarily allow packets through TCP port 3211), and use the following command: hping3 --flood -p 3211 -S <ip of PC with firebwall> This will spam the given "
+ "IP with TCP packets, destined for port 3211\n\n"
+ "FRAGGLE ATTACK\nA fraggle attack is a UDP flood of echo traffic to IP broadcast addresses. When it hits the broadcast address, its spammed throughout the entire"
+ " block of IPs, then those IPs all reply to the spoof source address. These packets usually have empty packet headers and are destined for a select few ports, "
+ " typically 7, 13, 17, and 19.\n\n"
+ "SMURF ATTACK\nMuch like the fraggle attack, this flood takes advantage broadcast addresses, though instead of UDP traffic it's ICMP. An attacker A sends "
+ " a slew of echo requests towards a router broadcat address, spoofed with the source address of the victim. The router then sends all the ICMP echo requests to "
+ " every IP it has. These systems then send back an echo reply towards the spoofed address, the victim. Modern systems have these capabilites disabled, but there"
+ " are still unpatched systems that hive this vulnerability (use nmap if you're bored)."
+ "\n\nThe DoS Threshold setting allows you to control what too many packets per second actually means. The default value is 10ms (meaning, "
+ " if more than X packets fly in with less than 10ms between them, block the IP). If you're unsure, or you're getting too many false positives, "
+ " try adjusting this number. Please supply logs and pcaps if you have any inquries regarding this.";
MetaData = new ModuleMeta(m);
Language lang = Language.ENGLISH;
multistring.SetString(lang, "DoS Log", "DoS attempt detected from IP {0} (likely spoofed). Packets from this IP will be dropped. You can unblock this IP from the module interface.");
multistring.SetString(lang, "Fraggle Log", "Potential fraggle attack from IP {0} (likely spoofed). Packets from this IP will be dropped. You can unblock this IP from the module interface.");
multistring.SetString(lang, "Smurf Log", "Potential Smurf attack from IP {0} (likely spoofed). Packets from this IP will be dropped. You can unblock this IP from the module interface.");
lang = Language.DUTCH;
multistring.SetString(lang, "DoS Log", "Dos poging gedetecteerd vanaf IP {0} (waarschijnlijk vals zijn). Pakketten van dit IP-adres zullen worden gedropt. U kunt deblokkeren dit IP-adres van de module interface.");
multistring.SetString(lang, "Fraggle Log", "Potentiële Fraggle aanval van IP {0} (waarschijnlijk vals zijn). Pakketten van dit IP-adres zullen worden gedropt. U kunt deblokkeren dit IP-adres van de module interface.");
multistring.SetString(lang, "Smurf Log", "Potentiële smurf aanval van IP {0} (waarschijnlijk vals zijn). Pakketten van dit IP-adres zullen worden gedropt. U kunt deblokkeren dit IP-adres van de module interface.");
lang = Language.CHINESE;
multistring.SetString(lang, "DoS Log", "DOS尝试检测IP {0}（可能伪造). 从这个IP数据包将被丢弃。从模块的接口，你可以疏通这一个IP。 ");
multistring.SetString(lang, "Fraggle Log", "从知识产权的潜在Fraggle攻击 {0}（可能伪造). 从这个IP数据包将被丢弃。从模块的接口，你可以疏通这一个IP。");
multistring.SetString(lang, "Smurf Log", "从 IP {0}（可能带有欺骗性质） 的潜在 smurf 攻击。从这个IP数据包将被丢弃。从模块的接口，你可以疏通这一个IP。");
lang = Language.FRENCH;
multistring.SetString(lang, "DoS Log", "DoS tentative détecté d'IP {0} (probablement le nom usurpé). Les paquets de cette IP seront supprimées. Vous pouvez débloquer cette IP de l'interface du module.");
multistring.SetString(lang, "Fraggle Log", "Attaque de fraggle potentielle de IP {0} (probablement le nom usurpé). Les paquets de cette IP seront supprimées. Vous pouvez débloquer cette IP de l'interface du module.");
multistring.SetString(lang, "Smurf Log", "Attaque smurf potentielle de IP {0} (probablement le nom usurpé). Les paquets de cette IP seront supprimées. Vous pouvez débloquer cette IP de l'interface du module.");
lang = Language.GERMAN;
multistring.SetString(lang, "DoS Log", "DoS Versuch erkannt von IP {0} (wahrscheinlich gefälscht). Pakete von dieser IP-Adresse werden verworfen werden. Sie können diese IP-Adresse von der Schnittstelle des Funktionsbausteins freizugeben.");
multistring.SetString(lang, "Fraggle Log", "Potenzielle Fraggle-Angriff von IP {0} (wahrscheinlich gefälscht). Pakete von dieser IP-Adresse werden verworfen werden. Sie können diese IP-Adresse von der Schnittstelle des Funktionsbausteins freizugeben.");
multistring.SetString(lang, "Smurf Log", "Potenzielle Smurf-Angriff von IP {0} (wahrscheinlich gefälscht). Pakete von dieser IP-Adresse werden verworfen werden. Sie können diese IP-Adresse von der Schnittstelle des Funktionsbausteins freizugeben.");
lang = Language.ITALIAN;
multistring.SetString(lang, "DoS Log", "DoS tentativo rilevato da IP {0} (probabilmente spoofing). I pacchetti da questo IP saranno essere ignorati. È possibile sbloccare questo IP dell'interfaccia del modulo.");
multistring.SetString(lang, "Fraggle Log", "Fraggle potenziale attacco da IP {0} (probabilmente spoofing). I pacchetti da questo IP saranno essere ignorati. È possibile sbloccare questo IP dell'interfaccia del modulo.");
multistring.SetString(lang, "Smurf Log", "Puffo potenziale attacco da IP {0} (probabilmente spoofing). I pacchetti da questo IP saranno essere ignorati. È possibile sbloccare questo IP dell'interfaccia del modulo.");
lang = Language.JAPANESE;
multistring.SetString(lang, "DoS Log", "DoS から ip アドレスを検出しようとすると {0} (スプーフィングの可能性が高い). この ip アドレスからのパケットが破棄されます。このモジュール インターフェイスから ip アドレスのブロックを解除することができます。");
multistring.SetString(lang, "Fraggle Log", "潜在的な fraggle 攻撃から IP {0} (偽装されている可能性があります)。 この ip アドレスからのパケットが破棄されます。このモジュール インターフェイスから ip アドレスのブロックを解除することができます。");
multistring.SetString(lang, "Smurf Log", "潜在的なスマーフ攻撃から IP {0} (偽装されている可能性があります)。この ip アドレスからのパケットが破棄されます。このモジュール インターフェイスから ip アドレスのブロックを解除することができます。");
lang = Language.PORTUGUESE;
multistring.SetString(lang, "DoS Log", "DoS tentativa detectada do IP {0} (provavelmente falsificado). Pacotes este IP serão descartados. Você pode desbloquear esse IP da interface do módulo.");
multistring.SetString(lang, "Fraggle Log", "Ataque fraggle potencial de IP {0} (provavelmente falsificado). Pacotes este IP serão descartados. Você pode desbloquear esse IP da interface do módulo.");
multistring.SetString(lang, "Smurf Log", "Ataque smurf potencial de IP {0} (provavelmente falsificado). Pacotes este IP serão descartados. Você pode desbloquear esse IP da interface do módulo.");
lang = Language.RUSSIAN;
multistring.SetString(lang, "DoS Log", "DoS попытка от IP {0} (скорее всего подмененным). Пакеты с этого IP-адреса будут удалены. Можно разблокировать этот IP от интерфейса модуля.");
multistring.SetString(lang, "Fraggle Log", "Потенциальные fraggle атака с IP {0} (вероятно ложным). Пакеты с этого IP-адреса будут удалены. Можно разблокировать этот IP от интерфейса модуля.");
multistring.SetString(lang, "Smurf Log", "Потенциальные атаки smurf от IP {0} (вероятно ложным). Пакеты с этого IP-адреса будут удалены. Можно разблокировать этот IP от интерфейса модуля.");
lang = Language.SPANISH;
multistring.SetString(lang, "DoS Log", "DoS intento detectado desde IP {0} (probablemente falsa). Se quitarán los paquetes desde esta dirección IP. Puede desbloquear esta IP de la interfaz del módulo.");
multistring.SetString(lang, "Fraggle Log", "Ataque potencial fraggle de IP {0} (probablemente falseada). Se quitarán los paquetes desde esta dirección IP. Puede desbloquear esta IP de la interfaz del módulo.");
multistring.SetString(lang, "Smurf Log", "Potencial ataque smurf desde IP {0} (probablemente falseada). Se quitarán los paquetes desde esta dirección IP. Puede desbloquear esta IP de la interfaz del módulo.");
}