Detecting Packets That Use IP Options for Reconnaissance

Attackers can use the record route, timestamp, security, and stream ID IP options for reconnaissance or for some unknown but suspect purpose. To detect packets with these options set, you can use either J-Web or the CLI configuration editor.

This topic covers:

• J-Web Configuration
• CLI Configuration

J-Web Configuration

To configure screen and assign an Internet Protocol (IP) to it:

1. Select CLI Tools>Point and Click CLI.
2. Next to Security, click Configure or Edit.
3. Next to Screen, click Edit.
4. Next to Ids option, click Add new entry.
5. In the Name box, type ip-record-route.
6. Next to Ip, click Configure.
7. Next to Record route option, select the check box and click OK.
8. Next to Ids option, click Add new entry.
9. In the Name box, type ip-timestamp-opt.
10. Next to Ip, click Edit.
11. Next to Timestamp option, select the check box and click OK.
12. Next to Ids option, click Add new entry.
13. In the Name box, type ip-security-opt.
14. Next to Ip, click Edit.
15. Next to Security option, select the check box and click OK.
16. In the Name box, type ip-stream-opt.
17. Next to Ip, click Edit.
18. Next to Stream option, select the check box and click OK.
19. To save and commit the configuration, click Commit.

To configure zones:

1. Select CLI Tools>Point and Click CLI.
2. Next to Security, click Configure or Edit.
3. Next to Zones, click Configure.
4. Next to Security zone, click Add new entry.
5. In the Name box, type zone.
6. In the Screen box, type ip-record-route-opt and click OK.
7. Next to Security zone, click Add new entry.
8. In the Name box, type zone.
9. In the Screen box, type ip-timestamp-opt and click OK.
10. Next to Security zone, click Add new entry.
11. In the Name box, type zone.
12. In the Screen box, type ip-security-opt and click OK.
13. Next to Security zone, click Add new entry.
14. In the Name box, type zone.
15. In the Screen box, type ip-stream-opt and click OK.
16. To save and commit the configuration, click Commit.

CLI Configuration