Kaspersky Endpoint Security 11 for Linux

Network Threat Protection

December 12, 2023

ID 11396

While the Network Threat Protection component is running, the application scans inbound network traffic for activity that is typical for network attacks. Network Threat Protection is started by default when the application starts.

This feature is not supported in the KESL container.

The application receives the numbers of the TCP ports from the current application databases and scans incoming traffic for these ports. Upon detecting an attempt of a network attack that targets your device, the application blocks network activity from the attacking device and logs an event about the detected network activity.

To scan network traffic, the Network Threat Protection task receives port numbers from the application databases and accepts connections via all these ports. During the network scan process, it may look like an open port on the device, even if no application on the system is listening to this port. It is recommended to close unused ports by means of a firewall.

Network Threat Protection settings

Setting

Description

Network Threat Protection enabled / disabled

This toggle button enables or disables Network Threat Protection.

The check toggle button is switched on by default.

Action on threat detection

Actions performed upon detection of network activity that is typical of network attacks.

  • Notify user. The application allows network activity and logs information about detected network activity.
  • Block network activity from an attacking device and log information about detected network activity (default value).

Blocking attacking devices enabled / disabled

This toggle button enables or disables blocking network activity when a network attack attempt is detected.

The check toggle button is switched on by default.

Block the attacking host for (min)

In this field you can specify the duration an attacking device is blocked in minutes. After the specified time, Kaspersky Endpoint Security allows network activity from this device.

Available values: integer from 1 to 32768.

Default value: 60.

Trusted IP addresses

The table contains a list of IP addresses. Network attacks from these addresses will not be blocked. By default, the list is empty.

You can add, edit, and remove IP addresses in the table.

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.