Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

What is a Large Size ICMP Packet (Size > 1024) Screen Protection ?

0

0

Article ID: KB4716 KB Last Updated: 22 Jun 2010Version: 3.0
Summary:
Internet Control Message Protocol (ICMP) provides error reporting and network probe capabilities. Because ICMP packets contain very short messages, there is no legitimate reason for large ICMP packets. If an ICMP packet is unusually large, something is wrong. For example, the Loki program uses ICMP as a channel for transmitting covert messages. The presence of large ICMP packets might expose a compromised machine acting as a Loki agent. It also might indicate some other kind of questionable activity.

ScreenOS provides protection against such Large Size ICMP Packet (Size > 1024) .
Symptoms:

Solution:

Note: This article applies to ScreenOS 4.0 and higher.


When you enable the Large Size ICMP Packet Protection SCREEN option, the security device drops ICMP packets with a length greater than 1024 bytes.
To block large ICMP packets, do either of the following, where the specified security zone is the one from which the ICMP packets originate:


WebUI
Screening > Screen (Zone: select a zone name): Select Large Size ICMP Packet
(Size > 1024) Protection, then click Apply.


CLI
set zone <zone-name> screen icmp-large


Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search