Fortinet IPS manual Predefined Icmp signatures

The FortiGate IPS response to ICMP sweep attacks ICMP sweep attacks

Predefined ICMP signatures

Table 11 describes all the ICMP-related predefined signatures and the default settings for each.

Note: The predefined signature descriptions in Table 11 are accurate as of the IPS Guide publication date. Predefined signatures may be added or changed with each Attack Definition update.

Table 11: Predefined ICMP sweep signatures

Signature	Description	Default settings
AddressMask.	AddressMask detects broadcast address mask	Signature enabled
Request	request messages from a host pretending to be	Logging enabled
	part of the network. The default action is to	Action: Pass
	pass but log this traffic because it could be
	legitimate network traffic on some networks.
Broadscan.Smurf.	Broadscan is a hacking tool used to generate	Signature enabled
Echo.Request	and broadcast ICMP requests in a smurf	Logging enabled
	attack. In a smurf attack, an attacker	Action: Drop
	broadcasts ICMP requests on Network A using
	a spoofed source IP address belonging to
	Network B. All hosts on Network A send
	multiple replies to Network B, which becomes
	flooded.
Communication.	This signature detects network packets that	Signature enabled
Administratively.	have been blocked by some kind of filter. The	Logging enabled
Prohibited.Reply	host that blocked the packet sends an ICMP	Action: Pass
	(code 13) Destination Unreachable message
	notifying the source or apparent source of the
	filtered packet. Since this signature may be
	triggered by legitimate traffic, the default action
	is to pass but log the traffic, so it can be
	monitored.
CyberKit.2.2.	CyberKit 2.2 is Windows-based software used	Signature enabled
Echo.Request	to scan networks. ICMP echo request	Logging enabled
	messages sent using this software contain	Action: Pass
	special characters that identify Cyberkit as the
	source.
DigitalIsland.	Digital Island is a provider of content delivery	Signature enabled
Bandwidth.Query	networks. This company sends ICMP pings so	Logging enabled
	they can better map routes for their customers.	Action: Drop
	Use this signature to block their probes.
Echo.Reply	This signature detects ICMP echo reply	Signature disabled
	messages responding to ICMP echo request
	messages.
ISS.Pinger.Echo.	ISS is Internet Security Scanner software that	Signature enabled
Request	can be used to send ICMP echo request	Logging enabled
	messages and other network probes. While	Action: Drop
	this software can be legitimately used to scan
	for security holes, use the signature to block
	unwanted scans.
Nemesis.V1.1.	Nemesis v1.1 is a Windows- or Unix-based	Signature enabled
Echo.Request	scanning tool. ICMP echo request messages	Logging enabled
	sent using this software contain special	Action: Drop
	characters that identify Nemesis as the source.
Oversized.Echo.	This signature detects ICMP packets larger	Signature enabled
Request.Packet	than 32 000 bytes, which can crash a server or	Logging enabled
	cause it to hang.	Action: Pass

	FortiGate IPS User Guide Version 3.0 MR7
56	01-30007-0080-20080916