ICMP packets contain very short messages, there is no legitimate
reason for ICMP packets to be fragmented.
If an ICMP packet is unusually large, something is wrong. For example,
the Loki program uses ICMP as a channel for transmitting covert
messages. The presence of large ICMP packets might expose a
compromised machine acting as a Loki agent. It might also indicate
some other kind of shifty activity.
When the the Large Size ICMP Packet Protection SCREEN option is enabled,
the device drops ICMP packets with a length greater than 1024 bytes.
This attribute records the detection of large ICMP packets.