PortScanDetectionEnabled Property of the IFPCAttackDetection Interface

Article
08/13/2010

The PortScanDetectionEnabled property gets or sets a Boolean value that indicates whether generating an event in response to a port scan attack is enabled.
A port scan attack is one in which an attempt is made to scan ports on a computer to detect services running on those ports.

C++

HRESULT put_PortScanDetectionEnabled(
    VARIANT_BOOL fPortScanDetectionEnabled
);
HRESULT get_PortScanDetectionEnabled(
    VARIANT_BOOL* pfPortScanDetectionEnabled
);

Parameters

fPortScanDetectionEnabled
Boolean value that indicates whether generating an event in response to a port scan attack is enabled.
pfPortScanDetectionEnabled
Pointer to a Boolean value that is set on return to VARIANT_TRUE if generating an event in response to a port scan attack is enabled, or to VARIANT_FALSE if generating an event in response to a port scan attack is disabled.

Return Value

These property methods return S_OK if the call is successful; otherwise, they return an error code.

Visual Basic

Property PortScanDetectionEnabled As Boolean

Property Value

Boolean value that indicates whether generating an event in response to a port scan attack is enabled.

Remarks

This property is read/write. Its default value is False (VARIANT_FALSE in C++).

Port scan attacks can be detected only if the IntrusionDetectionEnabled property is set to True (VARIANT_TRUE in C++).

When generating an event in response to a port scan attack is enabled, an event can be generated when a port scan attack is detected only if the condition specified by the PortScanDetectionAllPortsThreshold property or the condition specified by the PortScanDetectionWellKnownPortsThreshold property is also met.

Requirements

Client	Requires Windows 7 or Windows Vista.
Server	Requires Windows Server 2008 R2 or Windows Server 2008 x64 Edition with SP2.
Version	Requires Forefront Threat Management Gateway (TMG) 2010.
IDL	Declared in Msfpccom.idl.
DLL	Requires Msfpccom.dll.