NF – Echo Reply Payload – Bigger than 100 bytes
The rule detects ICMP Echo Reply packets with a payload size larger than 100 bytes. ICMP Echo Reply packets are typically responses to ICMP Echo (Ping) requests, and a larger payload in such responses may indicate potential abnormal or suspicious behavior, which could be worth investigating.
ID Number
5016112
Signature
alert icmp any any -> any any (msg:"NF - Echo Reply Payload - Bigger than 100 bytes"; icode:0; itype:0; dsize:>100; reference:url,networkforensic.dk; metadata:25032019; classtype:misc-activity; sid:5016112; rev:1;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the Link. If the link was approved - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.