| 12.5 |  | Shunning |
| 12.5.2 |  | Example of shunning an attacker |

| In Figure , host 172.26.26.45 has attempted a DNS zone transfer from host 192.168.0.10 using a source port other than the well-known DNS port of TCP 53. The offending host, 172.26.26.45, has made a connection with the victim host, 192.168.0.10, with TCP. The connection in the PIX Security Appliance connection table reads as follows:

172.26.26.45, 4000-> 10.0.0.11 PROT TCP

If the shun command is applied as shown in Figure , the PIX Security Appliance deletes the connection from its connection table and prevents packets from 172.26.26.45 from reaching the inside host. Packets from 172.26.26.45 will continue to be blocked until the blocking function is removed manually or by the Cisco IDS master unit.