TMS zl Module Release Notes ST.1.0.090603
Known Issues
Release ST.1.0.090213
Monitor Mode
■ PR_39263 — The following log messages are shown in Monitor Mode and are not applicable
to Monitor Mode: mid=625, mid=626, mid=675, mid=715, mid=1008, and mid=1356.
time="2009-04-15 15:59:01" severity=warning pri=4 fw=ProCurve-TMS-zl-Module
id=fw_l2l3_attack msg="FW: packet with invalid tcp flags found, packets
dropped" srczone=INTERNAL src=192.168.80.5 srcport=48654 dstzone=INTERNAL
dst=192.168.80.1 dstport=22 proto=TCP subfamid=packetheaderanomaly
mtype=attack mid=625
time="2009-04-15 15:59:02" severity=warning pri=5 fw=ProCurve-TMS-zl-Module
id=fw_access_control ruleid=10 msg="FW: packet appears after connection is
closed, packets dropped" srczone=INTERNAL src=192.168.80.5 srcport=48668
dstzone=INTERNAL dst=192.168.80.1 dstport=22 proto=TCP rcvd=0 rcvdsc=0
sent=0 sentsc=0 srcnatport=0 destnatport=0 destnatipaddr=0.0.0.0 subf-
amid=accessdeny mtype=access_control mid=626 srcnatipaddr=0.0.0.0
time="2009-04-15 16:14:04" severity=warning pri=4 fw=ProCurve-TMS-zl-Module
id=fw_l2l3_attack msg="TCP: invalid ACK packet, packets dropped"
srczone=INTERNAL src=192.168.80.5 srcport=60290 dstzone=INTERNAL
dst=192.168.80.1 dstport=22 proto=TCP subfamid=tcpconnectionanomaly
mtype=attack mid=675
time="2009-04-16 17:49:17" severity=minor pri=3 fw=ProCurve-TMS-zl-Module
id=system_error msg="FW: ICMP echo packets exceeds to maximum limit,
connection dropped" srczone=UNKNOWN_ZONE dstzone=UNKNOWN_ZONE error-
type=memory_allocation subfamid=resourceallocationfailure mtype=syserr
mid=715
time="2009-04-16 18:08:59" severity=info pri=6 fw=ProCurve-TMS-zl-Module
id=fw_l2l3_attack msg="Overlapped IP fragment recieved"
srczone=UNKNOWN_ZONE src=10.29.32.10 dstzone=UNKNOWN_ZONE dst=88.1.10.12
proto=ICMP subfamid=intergritycheck mtype=attack mid=1008
time="2009-04-16 18:08:59" severity=critical pri=1
fw=ProCurve-TMS-zl-Module id=fw_l2l3_attack msg="IP fragment datalength is
not in units of 8 octets" srczone=UNKNOWN_ZONE src=0.0.0.0 srcport=0
dstzone=UNKNOWN_ZONE dst=0.0.0.0 dstport=0 proto=0 subfamid=intergritycheck
mtype=attack mid=1356
Release ST.1.0.090213
The following problems are known issues as of release ST.1.0.090213.
■ PR_0000000665 — When an IPv4 address is entered into a field, regardless of whether the
administrator is using the Web browser interface or CLI interface, the TMS zl Module is not
doing the complete validation on the address based upon the field being used. For example,
a multicast or broadcast address can be entered into source address fields. It is up to the
user to ensure the correctness of the address for the field in question.
26