Event generation on high ports of the signature DCE2_EVENT__CO_FRAG_GT_MAX_XMIT_FRAG (133:35:2)

[SupportAC]

Hi,

DCE2_EVENT__CO_FRAG_GT_MAX_XMIT_FRAG signature events are being generated, and when reviewing it we see that the detected traffic is on high ports, both in origin and destination. According to the rule the traffic it inspects is ICMP.

Are we interpreting it wrong, what does this rule check?

Thanks.