•
NoLog - No logging is carried out under normal circumstances.
•
LogSuspect - Logs duplicated fragments if the reassembly procedure has been affected by
"suspect" fragments.
•
LogAll - Always logs duplicated fragments.
Default: LogSuspect
Fragmented ICMP
Other than ICMP ECHO (Ping), ICMP messages should not normally be fragmented as they contain
so little data that fragmentation should never be necessary. FragmentedICMP determines the action
taken when NetDefendOS receives fragmented ICMP messages that are not either ICMP ECHO or
ECHOREPLY.
Default: DropLog
Minimum Fragment Length
Minimum Fragment Length determines how small all fragments, with the exception of the final
fragment, of a packet can be expressed in bytes.
Although the arrival of too many fragments that are too small may cause problems for IP stacks, it is
usually not possible to set this limit too high. It is rarely the case that senders create very small
fragments. However, a sender may send 1480 byte fragments and a router or VPN tunnel on the
route to the recipient subsequently reduce the effective MTU to 1440 bytes. This would result in the
creation of a number of 1440 byte fragments and an equal number of 40 byte fragments. Because of
potential problems this can cause, the default settings in NetDefendOS has been designed to allow
the smallest possible fragments, 8 bytes, to pass. For internal use, where all media sizes are known,
this value can be raised to 200 bytes or more.
Default: 8
Reassembly Timeout
A reassembly attempt will be interrupted if no further fragments arrive within Reassembly Timeout
seconds of receipt of the previous fragment.
Default: 65
Max Reassembly Time Limit
A reassembly attempt will always be interrupted Reassembly Time Limit seconds after the first
received fragment arrived.
Default: 90
Reassembly Done Limit
Once a packet has been reassembled, NetDefendOS is able to remember reassembly for this number
of seconds in order to prevent further fragments, for example old duplicate fragments, of that packet
from arriving.
Default: 20
13.7. Fragmentation Settings
Chapter 13. Advanced Settings
529
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...
