[9.065][BUG] IPv6 aiccu Protocol Anomaly / Invalid Traffic

Hi All
I'm using IPv6 with a SixXS Tunnel.

These are IPv6 ICMP packets from the SixXS Tunnel Host End Point.
I am continually getting
Top Rule ID Rule Name Group Events % of total
1 458 PROTOCOL-ICMP unassigned type 1 Protocol Anomaly / Invalid Traffic 1 326 48.59
2 459 PROTOCOL-ICMP unassigned type 1 undefined code Protocol Anomaly / Invalid Traffic 1 326 48.59

Please check to see if this traffic is being correctly handled.

Sorry I'm a bit busy at the moment to setup wireshark taps.

Mark

0 lmatt over 12 years ago

The rules 458 and 459 will be triggered if undefined ICMP Code/Type is detected.

It seams that a service use non-RFC-standards...
You can check the ips log on /var/log/ips.log to find out which service it could be
and decide whether you set the rules to alert only or not.

Cheers, Lukas
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to lmatt

Same issue.
Never was a problem, so somewhere the rule has been redefined?

@Mark, are you using the London broker/pop?

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Mark_D_01 over 12 years ago

Yes
gblon02 is the assigned POP.
The question is, is the ICMP traffic sent from this host (which I assume is a heartbeat):-
1. Properly formatted IPv6 ICMP traffic?
2. Is the Rule a False Positive or Correct?

Note I have added IPv6 ICMP Definitions to my machine.

Mark
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to Mark_D_01

The issue is not something new to this beta, it was happening under 9.00x so that sort of implies a broken or re-interpreted application of the rules.

Doesn't help fix the the problem though. What we are not hearing from is other users with a sixxs tunnel not terminating on the London pop.

So does that imply it is an issue with the London pop and should be raised in the sixxs forum?

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Mark_D_01 over 12 years ago

Which goes back to the request of Sohphos to put Wireshark across this as or look at it.
1. They have a client on the UTM.
2. They have the tools to diagnose where this (Anomaly) is.

This the IPv6 icmp packets from SixXS?
Is it the IPv6 ICMP stack in the UTM?
Is it the IPS?
Or maybe a number of other things?

With this information a factual discourse can be made.
[:)]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to Mark_D_01

For a little while this issue went away, but with the latest up2date I am again seeing Rules 460 and 461 active.
The source being my internal IPv6 interface.

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Tinkerbell over 12 years ago in reply to RFCat_vk_01

For a little while this issue went away, but with the latest up2date I am again seeing Rules 460 and 461 active.
The source being my internal IPv6 interface.

Hey ,
Issue is filed and tracked with mantis id: 25390

http://www.astaro.org/beta-versions/utm-9-1-public-beta/47017-9-080-bug-ips-bug-rule-460-461-a.html

Regards,
Bianca
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[9.065][BUG] IPv6 aiccu Protocol Anomaly / Invalid Traffic

Submitted a Tech Support Case lately from the Support Portal?