Cisco Systems OL-16647-01 Configuring the Fragment Size

27-17
Cisco ASDM User Guide
OL-16647-01
Chapter 27 Configuring Advanced Firewall Protection
Configuring the Fragment Size
Configuring the Fragment Size
By default, the security appliance allows up to 24 fragments per IP packet, and up to 200 fragments
awaiting reassembly. You might need to let fragments on your network if you have an application that
routinely fragments packets, such as NFS over UDP. However, if you do not have an application that
fragments traffic, we recommend that you do not allow fragments through the security appliance.
Fragmented packets are often used as DoS attacks.
Fields
• Fragment table:
– Interface—Lists the available interfaces of the security appliance.
– Size—Sets the maximum number of packets that can be in the IP reassembly database waiting
for reassembly. The default is 200.
– Chain Length—Specifies the maximum number of packets into which a full IP packet can be
fragmented. The default is 24 packets.
6152 400044 yppasswdd (YP password daemon)
Portmap Request
Informational Triggers when a request is made to the
portmapper for the YP password daemon
(yppasswdd) port.
6153 400045 ypupdated (YP update daemon)
Portmap Request
Informational Triggers when a request is made to the
portmapper for the YP update daemon
(ypupdated) port.
6154 400046 ypxfrd (YP transfer daemon) Portmap
Request
Informational Triggers when a request is made to the
portmapper for the YP transfer daemon
(ypxfrd) port.
6155 400047 mountd (mount daemon) Portmap
Request
Informational Triggers when a request is made to the
portmapper for the mount daemon (mountd)
port.
6175 400048 rexd (remote execution daemon)
Portmap Request
Informational Triggers when a request is made to the
portmapper for the remote execution daemon
(rexd) port.
6180 400049 rexd (remote execution daemon)
Attempt
Informational Triggers when a call to the rexd program is
made. The remote execution daemon is the
server responsible for remote program
execution. This may be indicative of an
attempt to gain unauthorized access to system
resources.
6190 400050 statd Buffer Overflow Attack Triggers when a large statd request is sent.
This could be an attempt to overflow a buffer
and gain access to system resources.
Table 27-3 Signature IDs and System Message Numbers (continued)
Signature
ID
Message
Number Signature Title Signature Type Description