icmp_land no esta entre las firmas predefinidas
Publicado: 19 Oct 2011, 17:18
Estoy presentando problemas de ataques con la siguiente firma Icmp_Land el caso es que entre las firmas predefinidas del ips no aparece para bloquearla. cuando busco en los log el ataque anomaly: ip_src_session, 5215 > threshold 5000, repeats 191 times y la referencia me envía [Debes identificarte para poder ver enlaces.]. version de firmware MR3 Patch 1. esperando pronta respuesta me despido
icmp_land
Release Date
Sep 11, 2006
Severity
critical
Impact
The target system can be crashed by the attack.
Description
It indicates that the system is under ICMP Land attack.
The ICMP Land attack is a denial-of-service attack. An attacker can send an ICMP packet to the target host where the source IP address of the ICMP packet has been spoofed to be that of the host itself.
Affected Products
Any unprotected system that is connected to the Internet is vulnerable to the ICMP Land attack.
Recommended Actions
The signature can be enabled to block this attack.
Coverage
IPS
VCM
icmp_land
Release Date
Sep 11, 2006
Severity
critical
Impact
The target system can be crashed by the attack.
Description
It indicates that the system is under ICMP Land attack.
The ICMP Land attack is a denial-of-service attack. An attacker can send an ICMP packet to the target host where the source IP address of the ICMP packet has been spoofed to be that of the host itself.
Affected Products
Any unprotected system that is connected to the Internet is vulnerable to the ICMP Land attack.
Recommended Actions
The signature can be enabled to block this attack.
Coverage
IPS
VCM