;COMMENT: Log Ping, TraceRoute and suspicious ICMP packets
;DESCRIPTION: Logs incoming Trace Route and Ping packets to the Security Alert Log. Additionally logs incoming IMCP redirects and out-of-bounds (non-standard) ICMP codes.

Incoming-ICMP-Redirect	
		Comment = "Warn of incoming ICMP redirect",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "Incoming ICMP redirect",
		Log-Details = "ICMP redirects are part of the router generated background noise on the Internet. The ICMP Redirect message instructs the routing table of the IP stack to update itself, for example to make the routing path between two hosts more direct. Hackers can also make use of the Redirection protocol and on higher Firewall Security Levels, the redirects are dropped.",
		Log-Severity = Warning,
		Direction = Incoming,
		ICMP-Type = Redirect

Incoming-Ping	
		Comment = "Warn of incoming Ping (ICMP echo)",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "Incoming Ping - ICMP ECHO (8)",
		Log-Details = "Ping is a sign that someone is trying to see if your computer responds to Internet traffic.",
		Log-Severity = Warning,
		Packet-Size = "<= 200",
		Direction = Incoming,
		ICMP-Type = Echo

Incoming-Ping-Big	
		Comment = "Warn of big incoming Ping (ICMP echo)",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "Large incoming Ping - ICMP ECHO (8)",
		Log-Details = "Big ping packets can be a sign that someone is trying to check out the capability of your network. Some attacks, like the famous Ping-of-Death rely on very big ping packets. Big pings also have valid uses, such as in the MTU discovery algorithms (such packets are often around 1500 bytes).",
		Log-Severity = Warning,
		Packet-Size = "> 200",
		Direction = Incoming,
		ICMP-Type = Echo

Incoming-TraceRoute	
		Comment = "Warn of incoming TraceRoute",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "Incoming TraceRoute packet",
		Log-Details = "Traceroute is used to determine the routing between systems on the Internet.",
		Log-Severity = Warning,
		Direction = Incoming,
		TTL = "=1"

ICMP-Bad-Code	
		Comment = "Warn of unknown ICMP code",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "Unknown ICMP type",
		Log-Details = "The ICMP packet had an out-of-bounds protocol code. The code tells what kind of ICMP protocol block the packet is. Typical examples are ECHO (ping) and ECHO reply (ping reply). A hacker may try to fill in an invalid code to test the response of the attacked IP stack. Out-of-bound values can also be explained by non-standard use of the ICMP code or newly added ICMP codes. Valid values range from 0 to 18.",
		Log-Severity = High,
		Direction = Incoming,
		ICMP-Type = ICMP-Out-Of-Range
