Cisco ASA 5505 Configuration Manual page 1122

Configuring IP Audit for Basic IPS Support
Table 52-1 Signature IDs and System Message Numbers (continued)
Signature Message
ID Number Signature Title
1103 400009 IP Overlapping Fragments (Teardrop) Attack
2000 400010 ICMP Echo Reply
2001 400011 ICMP Host Unreachable
2002 400012 ICMP Source Quench
2003 400013 ICMP Redirect
2004 400014 ICMP Echo Request
2005 400015 ICMP Time Exceeded for a Datagram Informational
2006 400016 ICMP Parameter Problem on
Datagram
2007 400017 ICMP Timestamp Request
Cisco ASA 5500 Series Configuration Guide using ASDM
52-8
Signature Type Description
Triggers when two fragments contained
within the same IP datagram have offsets that
indicate that they share positioning within the
datagram. This could mean that fragment A is
being completely overwritten by fragment B,
or that fragment A is partially being
overwritten by fragment B. Some operating
systems do not properly handle fragments that
overlap in this manner and may throw
exceptions or behave in other undesirable
ways upon receipt of overlapping fragments,
which is how the Teardrop attack works to
create a DoS.
Informational Triggers when a IP datagram is received with
the protocol field of the IP header set to 1
(ICMP) and the type field in the ICMP header
set to 0 (Echo Reply).
Informational Triggers when an IP datagram is received
with the protocol field of the IP header set to
1 (ICMP) and the type field in the ICMP
header set to 3 (Host Unreachable).
Informational Triggers when an IP datagram is received
with the protocol field of the IP header set to
1 (ICMP) and the type field in the ICMP
header set to 4 (Source Quench).
Informational Triggers when a IP datagram is received with
the protocol field of the IP header set to 1
(ICMP) and the type field in the ICMP header
set to 5 (Redirect).
Informational Triggers when a IP datagram is received with
the protocol field of the IP header set to 1
(ICMP) and the type field in the ICMP header
set to 8 (Echo Request).
Triggers when a IP datagram is received with
the protocol field of the IP header set to 1
(ICMP) and the type field in the ICMP header
set to 11(Time Exceeded for a Datagram).
Informational Triggers when a IP datagram is received with
the protocol field of the IP header set to 1
(ICMP) and the type field in the ICMP header
set to 12 (Parameter Problem on Datagram).
Informational Triggers when a IP datagram is received with
the protocol field of the IP header set to 1
(ICMP) and the type field in the ICMP header
set to 13 (Timestamp Request).
Chapter 52 Using Protection Tools
OL-20339-01