TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
467
traffic. The Information Request/Reply pair was intended to support self-configuring systems such as diskless
workstations, to allow them to discover their IP network prefixes at boot time. However, these messages are now
obsolete. The RARP and BOOTP protocols provide better mechanisms for a host to discover its own IP address. ICMP
Information Request/reply datagram should be never present in normal network traffic.
Signature ID: 12229
ICMP Information Reply undefined code
Threat Level: Information
Signature Description: This event is generated when an ICMP Information Reply datagram with an undefined ICMP
code is found in the network traffic. The Information Request/Reply pair was intended to support self-configuring
systems such as diskless workstations, to allow them to discover their IP network prefixes at boot time. However, these
messages are now obsolete. The RARP and BOOTP protocols provide better mechanisms for a host to discover its own
IP address. ICMP Information Request/reply datagram should be never present in normal network traffic.<br>Sending
a ICMP message with undefined ICMP Code values should be considered as a nefarious activity on the network.
Signature ID: 12230
ICMP Information Request
Threat Level: Information
Signature Description: This event is generated when an ICMP Information Request datagram is found in the network
traffic. The Information Request/Reply pair was intended to support self-configuring systems such as diskless
workstations, to allow them to discover their IP network prefixes at boot time. However, these messages are now
obsolete. The RARP and BOOTP protocols provide better mechanisms for a host to discover its own IP address. ICMP
Information Request/reply datagram should be never present in normal network traffic.<br>
Signature ID: 12231
ICMP Information Request undefined code
Threat Level: Information
Signature Description: This event is generated when an ICMP Information Request datagram with an undefined ICMP
code is found in the network traffic. The Information Request/Reply pair was intended to support self-configuring
systems such as diskless workstations, to allow them to discover their IP network prefixes at boot time. However, these
messages are now obsolete. The RARP and BOOTP protocols provide better mechanisms for a host to discover its own
IP address. ICMP Information Request/reply datagram should be never present in normal network traffic.<br>Sending
a ICMP message with undefined ICMP Code values should be considered as a nefarious activity on the network.
Signature ID: 12232
ICMP Mobile Host Redirect
Threat Level: Information
Signature Description: This event is generated when an ICMP Mobile Host Redirect datagram is found in the network
traffic. ICMP Mobile Host Redirect message (ICMP type 32) is defined for IHMP (Internet Mobile Host) application
protocol. This IETF draft was never ratified and this message should be never present in normal network traffic.
Signature ID: 12233
ICMP Mobile Host Redirect undefined code
Threat Level: Information
Signature Description: This event is generated when an ICMP Mobile Host Redirect datagram with an undefined
ICMP code is found in the network traffic. ICMP Mobile Host Redirect message (ICMP type 32) is defined for IHMP
(Internet Mobile Host) application protocol. This IETF draft was never ratified and this message should be never
present in normal network traffic. Sending a ICMP message with undefined ICMP Code values should be considered as
a nefarious activity on the network.