This section contains information about the size limits imposed on the protocols directly under IP level, such as TCP, UDP and ICMP.

The values specified here concern the IP data contained in packets. In the case of Ethernet, a single packet can contain up to 1,480 bytes of IP data without fragmentation. In addition to that, there is a further 20 bytes of IP header and 14 bytes of Ethernet header, corresponding to the maximum media transmission unit on Ethernet networks of 1,514 bytes.

Max TCP Len

Specifies the maximum size of a TCP packet including the header. This value usually correlates with the amount of IP data that can be accommodated in an unfragmented packet, since TCP usually adapts the segments it sends to fit the maximum packet size. However, this value may need to be increased by 20-50 bytes on some less common VPN systems.

System:/> set Settings LengthLimSettings MaxTCPLen=1480

Default: 1,480

Max UDP Length

Specifies in bytes the maximum size of a UDP packet including the header. This value may well need to be quite high, since many real-time applications use large, fragmented UDP packets. If no such protocols are used, the size limit imposed on UDP packets can probably be lowered to 1,480 bytes.

System:/> set Settings LengthLimSettings MAxUDPLen=60000

Default: 60,000

Max ICMP Length

Specifies in bytes the maximum size of an ICMP packet. ICMP error messages should never exceed 600 bytes, although Ping packets can be larger if so requested. This value may be lowered to 1,000 bytes if it is undesirable to use large Ping packets.

System:/> set Settings LengthLimSettings MaxICMPLen=10000

Default: 10,000

Max GRE Length

Specifies in bytes the maximum size of a GRE packet. GRE, Generic Routing Encapsulation, has various uses, including the transportation of PPTP, Point to Point Tunneling Protocol, data. This value should be set at the size of the largest packet allowed to pass through the VPN connections, regardless of its original protocol, plus approx. 50 bytes.

System:/> set Settings LengthLimSettings MaxGRELen=2000

Default: 2,000

Max ESP Length

Specifies in bytes the maximum size of an ESP packet. ESP, Encapsulation Security Payload, is used by IPsec where encryption is applied. This value should be set at the size of the largest packet allowed to pass through the VPN connections, regardless of its original protocol, plus approx. 50 bytes.

System:/> set Settings LengthLimSettings MaxESPLen=2000

Default: 2,000

Max AH Length

Specifies in bytes the maximum size of an AH packet. AH, Authentication Header, is used by IPsec where only authentication is applied. This value should be set at the size of the largest packet allowed to pass through the VPN connections, regardless of its original protocol, plus approx. 50 bytes.

System:/> set Settings LengthLimSettings MaxAHLen=2000

Default: 2,000

Max SKIP Length

Specifies in bytes the maximum size of a SKIP packet.

System:/> set Settings LengthLimSettings MaxSKIPLen=2000

Default: 2,000

MaxOSPF Len

Specifies the maximum size of an OSPF packet. OSPF is a routing protocol mainly used in larger LANs.

System:/> set Settings LengthLimSettings MaxOSPFLen=1480

Default: 1,480

Max IPIP/FWZ Length

Specifies in bytes the maximum size of an IP-in-IP packet. IP-in-IP is used by Checkpoint Firewall-1 VPN connections when IPsec is not used. This value should be set at the size of the largest packet allowed to pass through the VPN connections, regardless of its original protocol, plus approx. 50 bytes.

System:/> set Settings LengthLimSettings MaxIPIPLen=2000

Default: 2,000

Max IPsec IPComp Length

Specifies in bytes the maximum size of an IPComp packet.

System:/> set Settings LengthLimSettings MaxIPCompLen=2000

Default: 2,000

Max L2TP Length

Specifies in bytes the maximum size of a Layer 2 Tunneling Protocol packet.

System:/> set Settings LengthLimSettings MaxL2TPLen=2000

Default: 2,000

Max Other Length

Specifies in bytes the maximum size of packets belonging to protocols that are not specified above.

System:/> set Settings LengthLimSettings MaxOtherSubIPLen

Default: 1,480

Log Oversized Packets

Specifies if cOS Stream will log occurrences of oversized packets.

System:/> set Settings LengthLimSettings LogOversizedPackets=Yes

Default: Yes