https://community.extremenetworks.com/t5/extremeswitching-eos/apple-devices-triggering-hostdos-icmpsize/m-p/17589#M549 Hi,<BR /> <BR /> recently I have seen some Apple devices triggering the <I>HostDos icmpSize</I> check (set to the default size limit of 1024) on an S-Series:<BR /> <BR /> <BLOCKQUOTE>Event(Notice) for <I> - HostDoS[6] Attack ( icmpSize ) detected on vlan.0.<TAG> InPort() LEN(1398) DA(<DSTMAC>) SA(<SRCMAC>) C-TAG(8100:<TAGINHEX>) ETYPE(0800) SIP(<SRCIP>) DIP(<GWIP>) VER(4) HLEN(5) TOTALLEN(1376) PROTO(1) TOS(0) TTL(64) ICMP(8:0)<BR /> </GWIP></SRCIP></TAGINHEX></SRCMAC></DSTMAC></TAG></I></BLOCKQUOTE><BR /> Has anyone else seen this? Is this some (new?) iDevice feature, or connected with using e.g. a VPN on the iDevice?<BR /> <BR /> Thanks,<BR /> Erik<BR /> Mon, 26 Nov 2018 20:39:00 GMT Erik_Auerswald 2018-11-26T20:39:00Z https://community.extremenetworks.com/t5/extremeswitching-eos/apple-devices-triggering-hostdos-icmpsize/m-p/17589#M549 Hi,<BR /> <BR /> recently I have seen some Apple devices triggering the <I>HostDos icmpSize</I> check (set to the default size limit of 1024) on an S-Series:<BR /> <BR /> <BLOCKQUOTE>Event(Notice) for <I> - HostDoS[6] Attack ( icmpSize ) detected on vlan.0.<TAG> InPort() LEN(1398) DA(<DSTMAC>) SA(<SRCMAC>) C-TAG(8100:<TAGINHEX>) ETYPE(0800) SIP(<SRCIP>) DIP(<GWIP>) VER(4) HLEN(5) TOTALLEN(1376) PROTO(1) TOS(0) TTL(64) ICMP(8:0)<BR /> </GWIP></SRCIP></TAGINHEX></SRCMAC></DSTMAC></TAG></I></BLOCKQUOTE><BR /> Has anyone else seen this? Is this some (new?) iDevice feature, or connected with using e.g. a VPN on the iDevice?<BR /> <BR /> Thanks,<BR /> Erik<BR /> Mon, 26 Nov 2018 20:39:00 GMT https://community.extremenetworks.com/t5/extremeswitching-eos/apple-devices-triggering-hostdos-icmpsize/m-p/17589#M549 Erik_Auerswald 2018-11-26T20:39:00Z