Справочник Пользователя для Fortinet IPS

 describes all the ICMP-related predefined signatures and the default 

settings for each. 

Note: The predefined signature descriptions in 

 are accurate as of the IPS Guide 

publication date. Predefined signatures may be added or changed with each Attack Definition 
update.

Description

Default settings

AddressMask detects broadcast address mask 

request messages from a host pretending to be 

part of the network. The default action is to 

pass but log this traffic because it could be 

legitimate network traffic on some networks.

Signature enabled
Logging enabled
Action: Pass

Broadscan is a hacking tool used to generate 

and broadcast ICMP requests in a smurf 

attack. In a smurf attack, an attacker 

broadcasts ICMP requests on Network A using 

a spoofed source IP address belonging to 

Network B. All hosts on Network A send 

multiple replies to Network B, which becomes 

flooded.

Signature enabled
Logging enabled
Action: Drop

This signature detects network packets that 

have been blocked by some kind of filter. The 

host that blocked the packet sends an ICMP 

(code 13) Destination Unreachable message 

notifying the source or apparent source of the 

filtered packet. Since this signature may be 

triggered by legitimate traffic, the default action 

is to pass but log the traffic, so it can be 

monitored.

Signature enabled
Logging enabled
Action: Pass

CyberKit 2.2 is Windows-based software used 

to scan networks. ICMP echo request 

messages sent using this software contain 

special characters that identify Cyberkit as the 

source.

Signature enabled
Logging enabled
Action: Pass

Digital Island is a provider of content delivery 

networks. This company sends ICMP pings so 

they can better map routes for their customers. 

Use this signature to block their probes.

Signature enabled
Logging enabled
Action: Drop

This signature detects ICMP echo reply 

messages responding to ICMP echo request 

messages. 

Signature disabled

ISS is Internet Security Scanner software that 

can be used to send ICMP echo request 

messages and other network probes. While 

this software can be legitimately used to scan 

for security holes, use the signature to block 

unwanted scans.

Signature enabled
Logging enabled
Action: Drop

Nemesis v1.1 is a Windows- or Unix-based 

scanning tool. ICMP echo request messages 

sent using this software contain special 

characters that identify Nemesis as the source.

Signature enabled
Logging enabled
Action: Drop

This signature detects ICMP packets larger 

than 32 000 bytes, which can crash a server or 

cause it to hang. 

Signature enabled
Logging enabled
Action: Pass