CSA - Network Shield Rule Triggering for IGMP Packets

[mnlatif]

Hi,

Any ideas, why this Network Shield Rule (For Malicious Packet) is getting triggered for these IGMP Packets ?

TESTMODE: A packet with malicious content was detected. Reason: Malicious packet. IGMP: 10.1.2.136->224.0.0.22 type 0x22. The operation would have been denied.

TESTMODE: A packet with malicious content was detected. Reason: Malicious packet. IGMP: 10.1.2.144->224.0.0.1 type 0x11. The operation would have been denied.

As far I researched 0x11 (Query) and 0x22 (v3Report) are Valid IGMP Packets.

Thanks,

Naman

[carenas123]

Try these links:

http://www.cisco.com/en/US/products/sw/secursw/ps5057/products_qanda_item09186a008049ad72.shtml

http://www.cisco.com/en/US/products/sw/secursw/ps5057/products_configuration_guide_chapter09186a00805afcc5.html

[tsteger1]

I think these are benign (I'm assuming this is a NAT'd adapter?) and are legit multicast traffic. Since the rule is set to deny and log, you are getting the messages.

If they weren't going to a multicast address (in this case igmp.mcast.net), you might get concerned.

Tom