Juniper Js Screen Monitor Icmp Large

1.3.6.1.4.1.2636.3.39.1.8.1.1.1.1.25

ICMP packets contain very short messages, there is no legitimate reason for ICMP packets to be fragmented. If an ICMP packet is unusually large, something is wrong. For example, the Loki program uses ICMP as a channel for transmitting covert messages. The presence of large ICMP packets might expose a compromised machine acting as a Loki agent. It might also indicate some other kind of shifty activity. When the the Large Size ICMP Packet Protection SCREEN option is enabled, the device drops ICMP packets with a length greater than 1024 bytes. This attribute records the detection of large ICMP packets.