The following are Bad IP Packet
signatures:
- 1101—Unknown IP Protocol (severity
1, information): This signature is triggered when an IP datagram
is received with the protocol field set to 101 or greater. These
protocol types are undefined or reserved and should not be used.
Use of undefined or reserved protocol types may indicate
establishment of a proprietary communication channel. No known
exploits implement this concept. This does not preclude the
possibility that exploits do exist outside of the realm of Cisco
Systems' knowledge domain.
- 1102—Impossible IP Packet (severity
5, DoS): This is triggered when an IP packet arrives with source
equal to destination address. This signature will catch the
so-called Land Attack.
|
|
