Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Security Best Practice: Familiarize Yourself with the Max Ping Size Protection

Subscribe

Check Point Reference: SBP-2008-27
Date Published:
Severity:
Source: IPS Research Center
Industry Reference(s): CVE-2002-0237
CVE-2001-0754
CVE-2001-0752
CVE-2001-0057
CVE-2000-0418
CVE-1999-0484
Protection Provided by: Security Gateway
  • R70
VPN-1
  • NGX R65
VSX
  • NGX R65
Who is Vulnerable?
Computers and Networks
Vulnerability Description
Ping is a computer network administration utility used to test whether a particular host is reachable across an IP network and to measure the round-trip time for packets sent from the local host to a destination computer, including the local host's own interfaces.

Ping operates by sending Internet Control Message Protocol (ICMP) echo request packets to the target host and waits for an ICMP response. In the process it measures the round-trip time and records any packet loss. The results of the test are printed in form of a statistical summary of the response packets received, including the minimum, maximum, and the mean round-trip times, and sometimes the standard deviation of the mean.
Vulnerability Details
An attacker might echo the client with large data, trying to compromise the security of the client's machine (for example causing a buffer overflow).

Protection Overview
This protection allows you to limit the maximum allowed data size for an ICMP echo request.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Network Security > IP and ICMP.
2. In the right pane, double-click the Max Ping Size protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Large Ping
Attack Information: Echo request too big

VPN-1 NGX R65 & VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Network Security > IP and ICMP.
2. Select the following protection:

Max Ping Size

3. In the configuration pane, under Settings > Mode, check Active. Apply additional settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Large Ping
Attack Information: Echo request too big