topic Re: SMB IPS Max Ping Size Attack in Spark Firewall (SMB)

SMB IPS Max Ping Size Attack

G_W_Albrecht — Wed, 17 Apr 2019 12:23:09 GMT

During the tests for CPs WatchTower App, i found a most interesting entry in Statistics:

Who is responsible for this traffic ? In logs i could see that my iPhone, connected to SMB wireless, has sent the package to LAN6 Switch where the Wireless network is defined. Why that ? Unclear RFC ?

But we have exceptions ready:

Since that was defined, no more Max Ping Size Attack has occured 😀 !

Re: SMB IPS Max Ping Size Attack

PhoneBoy — Fri, 19 Apr 2019 02:23:21 GMT

I saw it on my own gateway as well, and I'm pretty sure I didn't do a large ping through it. 😬
Probably worth a TAC case.

Re: SMB IPS Max Ping Size Attack

Vladimir — Fri, 19 Apr 2019 17:52:41 GMT

Same here.

Re: SMB IPS Max Ping Size Attack

Naftali_Oziel — Sun, 21 Apr 2019 11:46:50 GMT

Was a TAC opened for this? I've seen this on previous firmwares about the same attack.

Re: SMB IPS Max Ping Size Attack

Aidan_Luby — Wed, 24 Apr 2019 17:14:12 GMT

I believe I've verified that one of my sites with this message receives these hits from a Samsung Mobile device. I feel like maybe Samsung tries to do some connectivity tests when on WiFi that CheckPoint doesn't like. Not sure if anyone else can see the same thing.

Re: SMB IPS Max Ping Size Attack

Pedro_Espindola — Wed, 24 Apr 2019 19:27:24 GMT

Large ping to the default gateway is common in mobile devices.

Just bypass this protection from your wireless networks to the gateway.