TMS zl Module Release Notes ST.1.1.100330

Known Issues

Release ST.1.0.090603

time="2009-05-17 16:06:33" severity=major pri=2 fw=ProCurve-TMS-zl-Module

id=fw_l2l3_attack msg="Jolt attack detected" srczone=UNKNOWN_ZONE

src=192.168.70.67 srcport=0 dstzone=UNKNOWN_ZONE dst=192.016870.1 dstport=0

proto=UDP subfamid=dosattack mtype=attack mid=1001

time="2009-05-17 16:06:33" severity=major pri=2 fw=ProCurve-TMS-zl-Module

id=fw_l2l3_attack msg="PingOfDeath attack detected" srczone=UNKNOWN_ZONE

src=192.168.70.67 dstzone=UNKNOWN_ZONE dst=192.168.70.1 proto=ICMP subf-

amid=dosattack mtype=attack mid=1000

■ PR_40664 — Even though ICMP Error and ICMP Replay Message are not enabled in Attack

Protection, the following log entry is still generated.

time="2009-05-17 16:14:42" severity=warning pri=4 fw=ProCurve-TMS-zl-Module

id=fw_l2l3_attack msg="ICMP:Error message not allowed by firewall"

srczone=EXTERNAL src=192.168.80.100 dstzone=INTERNAL dst=192.168.70.100

proto=ICMP icmptype=3 subfamid=icmppacketanomaly mtype=attack mid=648 icmp-

code=1

■ PR_40665 — Some log entries for ALGs show that the max size has been exceed, but the

max size is not defined. For example:

time="2009-05-17 16:17:20" severity=warning pri=4 fw=ProCurve-TMS-zl-Module

id=fw_l2l3_attack msg="IRC:Size of Message is more than MAX_IRCSIZE"

srczone=INTERNAL src=192.168.80.100 srcport=39489 dstzone=EXTERNAL

dst=192.168.70.100 dstport=6667 proto=TCP subfamid=intergritycheck

mtype=attack mid=118

time="2009-05-17 16:11:58" severity=warning pri=4 fw=ProCurve-TMS-zl-Module

id=fw_l2l3_attack msg="TFTP-ALG: Request size length exceeded Max

size...dropping connection!" srczone=INTERNAL src=192.168.70.67

srcport=1599 dstzone=SELF dst=192.168.70.1 dstport=69 proto=UDP subf-

amid=intergritycheck mtype=attack mid=131

■ PR_40666 — TMS zl Module reports an entry in the log about being unable to complete

firewall processing due to a memory allocation failure, but does not experience any firewall

processing problems. For example:

time="2009-05-17 14:30:54" severity=minor pri=3 fw=ProCurve-TMS-zl-Module

id=system_error msg="FW: could not complete firewall processing due to

memory allocation failure" srczone=EXTERNAL dstzone=INTERNAL error-

type=memory_allocation subfamid=memoryallocationfailure mtype=syserr

mid=685

IPS

■ PR_38562 — The Port Scan IPS Signature category is listed in the Help file. It should be

removed as it describes functionality that is not present.