ZyXEL Communications ZyWall USG 2000 User Manual page 621

Table 168 HTTP Inspection and TCP/UDP/ICMP Decoders (continued)
LABEL
WEBROOT-DIRECTORY-
TRAVERSAL ATTACK
TCP Decoder
BAD-LENGTH-OPTIONS
ATTACK
EXPERIMENTAL-
OPTIONS ATTACK
OBSOLETE-OPTIONS
ATTACK
OVERSIZE-OFFSET
ATTACK
TRUNCATED-OPTIONS
ATTACK
TTCP-DETECTED ATTACK
UNDERSIZE-LEN ATTACK This is when a TCP packet is sent which has a TCP datagram
UNDERSIZE-OFFSET
ATTACK
UDP Decoder
OVERSIZE-LEN ATTACK
TRUNCATED-HEADER
ATTACK
UNDERSIZE-LEN ATTACK This is when a UDP packet is sent which has a UDP length
ICMP Decoder
TRUNCATED-ADDRESS-
HEADER ATTACK
ZyWALL USG 2000 User's Guide
DESCRIPTION
This is when a directory traversal traverses past the web
server root directory. This generates much fewer false
positives than the directory option, because it doesn't alert
on directory traversals that stay within the web server
directory structure. It only alerts when the directory
traversals go past the web server root directory, which is
associated with certain web attacks.
This is when a TCP packet is sent where the TCP option
length field is not the same as what it actually is or is 0.
This may cause some applications to crash.
This is when a TCP packet is sent which contains non-RFC-
complaint options. This may cause some applications to
crash.
This is when a TCP packet is sent which contains obsolete
RFC options.
This is when a TCP packet is sent where the TCP data offset
is larger than the payload.
This is when a TCP packet is sent which doesn't have
enough data to read. This could mean the packet was
truncated.
T/TCP provides a way of bypassing the standard three-way
handshake found in TCP, thus speeding up transactions.
However, this could lead to unauthorized access to the
system by spoofing connections.
length of less than 20 bytes. This may cause some
applications to crash.
This is when a TCP packet is sent which has a TCP header
length of less than 20 bytes.This may cause some
applications to crash.
This is when a UDP packet is sent which has a UDP length
field of greater than the actual packet length. This may
cause some applications to crash.
This is when a UDP packet is sent which has a UDP
datagram length of less the UDP header length. This may
cause some applications to crash.
field of less than 8 bytes. This may cause some applications
to crash.
This is when an ICMP packet is sent which has an ICMP
datagram length of less than the ICMP address header
length. This may cause some applications to crash.
Chapter 35 ADP
621