Signature Detail
Short Name |
ICMP:EXPLOIT:DIFF-CSUM-IN-RESP |
|---|---|
Severity |
High |
Recommended |
No |
Category |
ICMP |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
ICMP: Echo Reply Resent w/Different Checksum
This protocol anomaly triggers when it detects an ICMP echo reply retransmission (for example, with the same ID and sequence numbers) with a different checksum field. This can indicate data tunneling over ICMP.
Extended Description
Related ICMP Echo and Echo Reply checksums that do not match are protocol anomalies that could indicate that a transmission error has occurred, or that data tunneling over ICMP is taking place.
References