Geoff - I think, more accurately, that the packet is coming from the
TSM server system.

I recall this coming up in past List discussions. It may well be Path
MTU Discovery from your AIX OS.  Search ADSM QuickFacts for that
moniker for basic info, then see if your AIX system is set to do that.

   Richard Sims     http://people.bu.edu/rbs/ADSM.QuickFacts

On Sep 3, 2004, at 12:24 PM, Gill, Geoffrey L. wrote:

In an email sent to me from the network folks I've been asked why it
is they
have seen this a few times in monitoring the firewall traffic. If
anyone
with a bit of experience in this area be kind enough to reply please?
IP's
have been removed to protect the innocent......

Thanks,



00001] 2004-08-31 17:39:22 [Root]system-critical-00436: Large ICMP
packet!

From xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx, proto 1 (zone Untrust, int

ethernet1). Occurred 1 times.



This is coming from the TSM server to a node. The backup schedule is
set to
start at 17:30. Schedmode is polling.



TSM Server AIX 5.2 TSM 5.2.2.5

Client Sun Solaris  TSM 5.2.2.10

Geoff Gill
TSM Administrator
NT Systems Support Engineer
SAIC
E-Mail:   gillg AT saic DOT com
Phone:  (858) 826-4062
Pager:   (877) 854-0975