AT62: Invalid Packet Traffic
Definition
These settings are not for attack traffic as defined by the core 25 algorithmic attack types, but rather for malformed packets or other undesirable network traffic.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
Filter Mode
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
IP Protocol Controls
| Feature | Default Setting | Comments |
|---|---|---|
| Drop packets less than minimum length | Enabled | Enabling this drops packets whose IP length is smaller than the smallest valid length specified by their address family. |
| Drop packets with null IP address | Enabled | Drops packets without a destination address, or packets without a source address that aren't UDP DHCP messages. |
| Drop packets with invalid layer 3 length | Enabled | Drops unfragmented packets that have truncated protocol headers (TCP, UDP, ICMP) or whose total packet length is less than reported by the IP and TCP headers. |
| Drop packets with invalid layer 4 length | Enabled | Drops packets smaller than the TCP or UDP minimum size, missing their layer 4 payload, or where the lengths reoported in the layer 3 and layer 4 headers don't correlate. If the first fragment of a fragmented packet, it will also be dropped if the reported layer 3 packet length is greater than the layer 3 header length plus the layer 4 payload length. |
| Drop all TCP traffic | Disabled | Drops all TCP traffic. |
| Drop all UDP traffic | Disabled | Drops all UDP traffic. |
| Drop only HTTP/S destination port UDP packets | Disabled | Drops all UDP traffic with a destination port of 80, 8080, 443, or 8443 (standard web ports). This setting is mutually exclusive with Drop all UDP traffic. |
| Drop all ICMP traffic | Disabled | Drops all ICMP traffic. This option includes both ICMPv4 and ICMPv6. |
| Except ICMP ping request/response packets | Disabled | Drops all ICMP traffic except for pings. This setting can only be enabled if Drop all ICMP traffic is set. |
| Drop all GGP traffic | Enabled | Drops all GGP traffic. |
| Drop all other protocol traffic | Disabled | If enabled, drops all IP traffic that is not contained within one of the other Drop controls: TCP, UDP, ICMP (v4 or v6), GGP, or tunneled traffic. |
| Drop tunneled traffic (RIOS 8.7.0 or later) | Disabled | If enabled, this will drop encapsulated packets that are either IP in IP (protocol number 4), IPv6 encapsulated (protocol number 41), or GRE (protocol number 47). These protocols can be independently added to IP protocol numbers to exclude from drop rules to exempt them from drops. |
| Check tunneled IP header (RIOS 8.7.0 or later) | Enabled | When a device is set to no longer unwrap tunneled packets, it can still examine the innermost header of tunneled IP packets. If enabled, this control ensures that tunneled IPv4 or IPv6 header: 1. Is present and not truncated. 2. That both source and destination addresses are populated. 3. That the source and destination addresses are not identical. Violations of this rule are reported as subtype 30. |
| IP protocol numbers to exclude from drop rules (RIOS 7.0.0 or later) | A comma separated list of IP protocol number entries (integer values 0-255) that are exempted from the "Drop all XX traffic" controls above. For example, checking "Drop all other" protocol traffic (but leaving all other options unchecked) and adding 89 (OSPF's protocol number) in this would only allow TCP, UDP, ICMP, GGP, tunneled (protocols 4, 41 or 47), and OSPF packets in the zone. | |
| Block TCP TTL between (inclusive) | 0-0 (0-255, 0-255) | This option is disabled if both values are set to 0. Otherwise, any TCP packets with a TTL between the two values will be dropped. |
| Block UDP TTL between (inclusive) | 0-0 (0-255, 0-255) | This option is disabled if both values are set to 0. Otherwise, any UDP packets with a TTL between the two values will be dropped. |
| Block ICMP TTL between (inclusive) | 0-0 (0-255, 0-255) | This option is disabled if both values are set to 0. Otherwise, any ICMP packets with a TTL between the two values will be dropped. |
IPv4 Header Controls
| Feature | Default Setting | Comments |
|---|---|---|
| Drop packets with incomplete IP header | Enabled | Drops all packets whose last IP header is less than minimum header size or is otherwise truncated. |
| Drop invalid fragmentation bits packets | Enabled | Drops packets with an invalid combination of fragmentation bits set: 1. May Fragment set to True and Don't Fragment set to True OR 2. Don't Fragment set to True and Fragmentation Offset with nonzero value. |
| Drop private IP address packets | Enabled | Drops all traffic from private IPv4 spaces: 0.0.0.0/8- "This" Network RFC 1122, Section 3.2.1.3 10.0.0.0/8- Private-Use Networks RFC 1918 100.64.0.0/10- for ISP internal use RFC 6598 127.0.0.0/8- Loopback RFC 1122, Section 3.2.1.3 169.254.0.0/16- Link Local RFC 3927 172.16.0.0/12- Private-Use Networks RFC 1918 192.0.0.0/24- IETF Protocol Assignments RFC 5736 192.0.2.0/24- TEST-NET-1 RFC 5737 192.88.99.0/24- 6to4 Relay Anycast RFC 3068 192.168.0.0/16- Private-Use Networks RFC 1918 198.18.0.0/15- Network Interconnect Device Benchmark Testing RFC 2544 198.51.100.0/24- TEST-NET-2 RFC 5737 203.0.113.0/24- TEST-NET-3 RFC 5737 224.0.0.0/4- Multicast RFC 3171 240.0.0.0/4- Reserved for Future Use RFC 1112, Section 4 255.255.255.255/32- Limited Broadcast RFC 919, Section 7, RFC 922, Section 7 |
| Check header checksum | Enabled | Checks the IPv4 packet checksum, and drops it if it is incorrect. |
IPv6 Header Controls
| Feature | Default Setting | Comments |
|---|---|---|
| Drop packets with Misplaced Headers | Enabled | Enabling this drops packets that have a Hop-by-hop Extension Header that does not immediately follow the IPv6 Header. |
| Drop packets with Incomplete Headers | Enabled | Enabling this drops packets that have Extension Headers that are not complete (option data does not match the length). |
| Drop packets with Jumbo Payload | Disabled | Enabling this will drop all IPv6 Jumbo Payload Packets, regardless of size. |
| Maximum size of Jumbo Payload | 4294967295 (65536-4294967295) | This control sets the maximum allowable size of a Jumbo Payload IPv6 Packet. Packets exceeding this size will be dropped. If Drop packets with Jumbo Payload is enabled all Jumbo Payload packets will be dropped and this control will have no effect. |
| Maximum number of headers allowed | 255 (0-255) | This control determines the maximum number of Extension Headers allowed in an IPv6 packet. Packets with a greater number of headers will be dropped. |
| Maximum size of headers allowed | 2047 (0-2047) | This control is the maximum allowable size, in bytes, of an Extension Header. Packets that have at least one Extension Header that exceeds this size will be dropped. |
| Maximum number of tunnels allowed | 255 | |
| Maximum depth of Fragmentation allowed | 255 (0-255) | This control is the maximum number of allowed Fragmentation Extension Headers. Packets that have more Fragmentation headers than set in this control will be dropped. |
| Drop packets to Local IPv6 addresses | Disabled | Enabling this drops packets with IPv6 Local Addresses. |
| Drop all packets to Special addresses | Disabled | When selected, this control enables the remainder of the IPv6 controls listed below. |
| Exclude IPv4 compatible/mapped | Enabled | If disabled, packets in the IPv4 compatible/mapped address ranges will be dropped (::/96, ::ffff:0:0/96). |
| Exclude IPv6 loopback | Enabled | If disabled, packets from the IPv6 Loopback address will be dropped (::1/128) |
| Exclude IPv4 embedded IPv6 | Enabled | If disabled, IPv4 embedded packets will be dropped (2002::/16). |
| Exclude Discard prefix | Enabled | If disabled, packets using the designated Discard prefix will be dropped (100::/64). |
| Exclude Teredo | Enabled | If disabled, Teredo packets will be dropped (2001::/32). |
| Exclude benchmark | Enabled | If disabled, packets from the IPv6 benchmark range will be dropped (2001:2::/48). |
| Exclude ORCHID | Enabled | If disabled, packets from the ORCHID (Overlay Routable Cryptographic Hash Identifiers) range will be dropped (2001:10::/28). |
| Exclude multicast | Enabled | If disabled, multicast addressed packets will be dropped (ff00::/8). |
| Exclude Other reserved | Enabled |
TCP Protocol Controls
| Feature | Default Setting | Comments |
|---|---|---|
| Drop TCP null flags packets | Enabled | Drops TCP packets with no flags set. |
| Drop TCP invalid flags packets | Enabled | Drops packets with invalid combinations of TCP flags set. |
| Drop null source or destination port packets (RIOS 5.2.8sp1 or later) | Enabled | Drops TCP packets with source or destination ports of 0. |
| Allow Partial Headers | Enabled | This setting if enabled means all TCP packets with partial headers in the first fragment and the middle fragment are allowed. |
| Enforce RFC1858 | Enabled | This setting enforces that all TCP middle fragments with a fragment offset of --1 are dropped. |
| Check packet checksum (RIOS 8.2.0 or later) | Enabled | This setting verifies the checksum of TCP headers, dropping packets if they are incorrect. |
UDP Protocol Controls
| Feature | Default Setting | Comments |
|---|---|---|
| Drop null destination port packets (RIOS 5.2.8sp1 or later) | Enabled | Drops UDP packets with source or destination ports of 0. |
| Allow Partial Headers | Enabled | This setting if enabled means all UDP packets with partial headers in the first fragment and the middle fragment are allowed. |
| Check packet checksum (RIOS 8.2.0 or later) | Enabled | This setting verifies the checksum of UDP headers, dropping packets if they are incorrect. |
ICMP Protocol Controls
| Feature | Default Setting | Comments |
|---|---|---|
| Allow Partial Headers | Enabled | This setting if enabled means all ICMP packets with partial headers in the first fragment and the middle fragment are allowed. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table:
| Attack Type | Subtype | Details | Type |
|---|---|---|---|
| AT62 | 1 | Protocol not allowed | ACL |
| AT62 | 2 | Incomplete packet header | Invalid |
| AT62 | 3 | Invalid layer 4 packet length | Invalid |
| AT62 | 4 | Invalid IP address | Invalid |
| AT62 | 6 | TTL matches blocked values | ACL |
| AT62 | 7 | Invalid IP header flags | Invalid |
| AT62 | 8 | Private IP address | ACL |
| AT62 | 9 | Partial protocol header | ACL |
| AT62 | 10 | Middle fragment with protocol header | ACL |
| AT62 | 11 | Fragment overwrites protocol header (RFC1858) | ACL |
| AT62 | 12 | Invalid TCP source or destination port | Invalid |
| AT62 | 13 | Invalid TCP flags | Invalid |
| AT62 | 14 | No TCP flags | Invalid |
| AT62 | 15 | Invalid UDP destination port | Invalid |
| AT62 | 16 | Destination port closed | ACL |
| AT62 | 18 | Invalid checksum - Any checksum if RIOS < 8.3.0 (IPv4, TCP, UDP) - IPv4 only if RIOS >= 8.3.0 | Invalid |
| AT62 | 19 | Invalid IPv4 header length | Invalid |
| AT62 | 20 | Invalid packet length | Invalid |
| AT62 | 21 | IPv6 extension header out of order | Invalid |
| AT62 | 22 | Bad IPv6 jumbo payload size | ACL |
| AT62 | 23 | IPv6 extension header count exceeded | ACL |
| AT62 | 24 | IPv6 extension header size exceeded | ACL |
| AT62 | 25 | Tunnel depth exceeded | ACL |
| AT62 | 26 | IPv6 nested fragmentation depth exceeded | ACL |
| AT62 | 27 | Prohibited IPv6 address | ACL |
| AT62 | 28 | Invalid TCP Checksum | Invalid |
| AT62 | 29 | Invalid UDP Checksum | Invalid |
| AT62 | 30 | Invalid tunneled IP packet | Invalid |