Icmp Vulnerability; Illegal Commands (Netbios And Smtp); Figure 63 Smurf Attack; Table 43 Icmp Commands That Trigger Alerts - ZyXEL Communications Prestige 2602HW Series User Manual

Prestige 2602HW Series User's Guide
amount of ICMP echo request and response traffic. If a hacker chooses to spoof the
source IP address of the ICMP echo request packet, the resulting ICMP traffic will not
only clog up the "intermediary" network, but will also congest the network of the spoofed
source IP address, known as the "victim" network. This flood of broadcast traffic
consumes all available bandwidth, making communications impossible.

Figure 63 Smurf Attack

13.4.2.1 ICMP Vulnerability

ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types
trigger an alert:

Table 43 ICMP Commands That Trigger Alerts

5
13
14
17
18

13.4.2.2 Illegal Commands (NetBIOS and SMTP)

The only legal NetBIOS commands are the following - all others are illegal.

Table 44 Legal NetBIOS Commands

MESSAGE:
REQUEST:
POSITIVE:
VE:
RETARGET:
KEEPALIVE:
All SMTP commands are illegal except for those displayed in the following tables.
154
REDIRECT
TIMESTAMP_REQUEST
TIMESTAMP_REPLY
ADDRESS_MASK_REQUEST
ADDRESS_MASK_REPLY
Chapter 13 Firewalls