GEN:SID 1:523
Message BAD-TRAFFIC ip reserved bit set
Summary This event is generated when packets on the network have the reserved
bit set.
Impact Possible prelude to system compromise.
Detailed Information Under normal circumstances IP packets do not use the reserved bit.

This may be an indicator of the use of the reserved bit by a malicious
user to instigate covert channel communications.

an indicator of unauthorized network use, reconnaisance activity or
system compromise. These rules may also generate an event due to
improperly configured network devices.
Affected Systems All
Attack Scenarios The attacker may send specially crafted packets with the reserved bit
set.
Ease of Attack Simple
Corrective Action Use a packet filtering device to reject packets with this bit set.
Additional References