Icmp Vulnerability; Traceroute; Figure 53 Smurf Attack; Table 48 Icmp Commands That Trigger Alerts - ZyXEL Communications ZyAir G-2000 PlusV2 User Manual

Figure 53 Smurf Attack

10.4.2.1 ICMP Vulnerability

ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types
trigger an alert:

Table 48 ICMP Commands That Trigger Alerts

5
13
14
17
18

10.4.2.2 Traceroute

Traceroute is a utility used to determine the path a packet takes between two endpoints.
Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute
the firewall gaining knowledge of the network topology inside the firewall.
Often, many DoS attacks also employ a technique known as "IP Spoofing" as part of their
attack. IP Spoofing may be used to break into systems, to hide the hacker's identity, or to
magnify the effect of the DoS attack. IP Spoofing is a technique used to gain unauthorized
access to computers by tricking a router or firewall into thinking that the communications are
coming from within the trusted network. To engage in IP spoofing, a hacker must modify the
packet headers so that it appears that the packets originate from a trusted host and should be
allowed through the router or firewall. The ZyXEL device blocks all IP Spoofing attempts.
Chapter 10 Firewalls
REDIRECT
TIMESTAMP_REQUEST
TIMESTAMP_REPLY
ADDRESS_MASK_REQUEST
ADDRESS_MASK_REPLY
ZyXEL G-2000 Plus v2 User's Guide
139