Fortinet Network Device IPS - Manual (Page 56)

FortiGate IPS User Guide Version 3.0 MR7
56 01-30007-0080-20080916
The FortiGate IPS response to ICMP sweep attacks ICMP sweep attacks
Predefined ICMP signatures
Table 11 describes all the ICMP-related predefined signatures and the default
settings for each.
Note: The predefined signature descriptions in Table 11 are accurate as of the IPS Guide
publication date. Predefined signatures may be added or changed with each Attack Definition
update.
Table 11: Predefined ICMP sweep signatures
Signature Description Default settings
AddressMask.
Request AddressMask detects broadcast address mask
request messages from a host pretending to be
part of the network. The default action is to
pass but log this traffic because it could be
legitimate network traffic on some networks.
Signature enabled
Logging enabled
Action: Pass
Broadscan.Smurf.
Echo.Request Broadscan is a hacking tool used to generate
and broadcast ICMP requests in a smurf
attack. In a smurf attack, an attacker
broadcasts ICMP requests on Network A using
a spoofed source IP address belonging to
Network B. All hosts on Network A send
multiple replies to Network B, which becomes
flooded.
Signature enabled
Logging enabled
Action: Drop
Communication.
Administratively.
Prohibited.Reply This signature detects network packets that
have been blocked by some kind of filter. The
host that blocked the packet sends an ICMP
(code 13) Destination Unreachable message
notifying the source or apparent source of the
filtered packet. Since this signature may be
triggered by legitimate traffic, the default action
is to pass but log the traffic, so it can be
monitored.
Signature enabled
Logging enabled
Action: Pass
CyberKit.2.2.
Echo.Request CyberKit 2.2 is Windows-based software used
to scan networks. ICMP echo request
messages sent using this software contain
special characters that identify Cyberkit as the
source.
Signature enabled
Logging enabled
Action: Pass
DigitalIsland.
Bandwidth.Query Digital Island is a provider of content delivery
networks. This company sends ICMP pings so
they can better map routes for their customers.
Use this signature to block their probes.
Signature enabled
Logging enabled
Action: Drop
Echo.Reply This signature detects ICMP echo reply
messages responding to ICMP echo request
messages.
Signature disabled
ISS.Pinger.Echo.
Request ISS is Internet Security Scanner software that
can be used to send ICMP echo request
messages and other network probes. While
this software can be legitimately used to scan
for security holes, use the signature to block
unwanted scans.
Signature enabled
Logging enabled
Action: Drop
Nemesis.V1.1.
Echo.Request Nemesis v1.1 is a Windows- or Unix-based
scanning tool. ICMP echo request messages
sent using this software contain special
characters that identify Nemesis as the source.
Signature enabled
Logging enabled
Action: Drop
Oversized.Echo.
Request.Packet This signature detects ICMP packets larger
than 32 000 bytes, which can crash a server or
cause it to hang.
Signature enabled
Logging enabled
Action: Pass