V-283891

Discussion

Fragmented ICMP packets can be generated by hackers for denial-of-service attacks such as Ping O' Death and Teardrop. It is imperative that all fragmented ICMP packets are dropped.

Check Content

Review the access control list (ACL) or filter for the router receive path.

Review the CPM filter to verify the router is configured to drop all fragmented ICMP packets destined to itself using the example below: 

- show system security cpm-filter ip-filter entry 10

CPM IP Filter Entry

Entry Id           : 10
Description        : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id             : n/a
Src. IP            : n/a
Src. Port          : n/a
Dst. IP            : n/a
Dest. Port         : n/a
Protocol           : icmp               Dscp               : Undefined
ICMP Type          : Undefined          ICMP Code          : Undefined
Fragment           : True               Option-present     : Off
IP-Option          : n/a                Multiple Option    : Off
TCP-syn            : Off                TCP-ack            : Off
Action             : Drop
Match Router ID    : n/a
Dropped pkts       : 0                  Forwarded pkts     : 0

If the router is not configured with a receive-path filter to drop all fragmented ICMP packets, this is a finding.