Too much IP fragmentation
advICE :Intrusions : 2000011

Summary

Denial of Service overload attempt.

Details

May indicate attempt to attack system, or may be simple spike in traffic. A large number of unprocessed fragments have been seen.

If you get this report frequently, and fragmentation often occurs on your network, you can adjust the amount of memory allocated for de-fragmentation by setting the ip.fragment.memory parameter.

configuration for this item ip.fragment.memory 500000 If the amount of memory used to handle fragmentation exceeds this number of bytes, an intrusion detection is triggered.

 
Version appeared: