TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
466
message are normal, but excessive generation of this event may be an indication of improperly configured hosts/routing
equipment or it may be due to some attacker sending a large number of specially-crafted fragmented packets to cause
denial of service. This message is also used some times for operating system fingerprinting.
Signature ID: 12224
ICMP IPV6 I-Am-Here
Threat Level: Information
Signature Description: This event is generated when an ICMP IPV6 I-Am-Here datagram is found in the network
traffic. ICMP IPV6 Where-Are-You message and ICMP IPv6 I-Am-Here message were part of a proposed RFC, which
would have made a great addition to the IP version 6 protocol. However, the proposal was discarded and never
translated into an RFC, and thus these are once reserved again. No proof-of-concept code is known which actually used
this functionality. ICMP IPV6 Where-Are-You message /ICMP IPv6 I-Am-Here datagram should be never present in
normal network traffic.
Signature ID: 12225
ICMP IPV6 I-Am-Here undefined code
Threat Level: Information
Signature Description: This event is generated when an ICMP IPV6 I-Am-Here datagram with an undefined ICMP
code is found in the network traffic. ICMP IPV6 Where-Are-You message and ICMP IPv6 I-Am-Here message were
part of a proposed RFC, which would have made a great addition to the IP version 6 protocol. However, the proposal
was discarded and never translated into an RFC, and thus these are once reserved again. No proof-of-concept code is
known which actually used this functionality. ICMP IPV6 Where-Are-You message /ICMP IPv6 I-Am-Here datagram
should be never present in normal network traffic.
Signature ID: 12226
ICMP IPV6 Where-Are-You
Threat Level: Information
Signature Description: This event is generated when an ICMP IPV6 Where-Are-You datagram is found in the network
traffic. ICMP IPV6 Where-Are-You message and ICMP IPv6 I-Am-Here message were part of a proposed RFC, which
would have made a great addition to the IP version 6 protocol. However, the proposal was discarded and never
translated into an RFC, and thus these are once reserved again. No proof-of-concept code is known which actually used
this functionality. ICMP IPV6 Where-Are-You message /ICMP IPv6 I-Am-Here datagram should be never present in
normal network traffic.
Signature ID: 12227
ICMP IPV6 Where-Are-You undefined code
Threat Level: Information
Signature Description: This event is generated when an ICMP IPV6 Where-Are-You datagram with an undefined
ICMP code is found in the network traffic. ICMP IPV6 Where-Are-You message and ICMP IPv6 I-Am-Here message
were part of a proposed RFC, which would have made a great addition to the IP version 6 protocol. However, the
proposal was discarded and never translated into an RFC, and thus these are once reserved again. No proof-of-concept
code is known which actually used this functionality. ICMP IPV6 Where-Are-You message /ICMP IPv6 I-Am-Here
datagram should be never present in normal network traffic.<br>Sending a ICMP message with undefined ICMP Code
values should be considered as a nefarious activity on the network.
Signature ID: 12228
ICMP Information Reply
Threat Level: Information
Signature Description: This event is generated when an ICMP Information Reply datagram is found in the network