For vlans/ports on which one or more of the IP Security 
features have been enabled, this trap will be generated when a packet 
received on that vlan/port is in violation of the configured IP 
Security protections

For ports on which the protocol anomaly protection IP 
features has been enabled, this trap will be generated when a packet 
received on that port if the packet's source IP == destination IP

For ports on which the protocol anomaly protection L4port 
features has been enabled, this trap will be generated when a packet 
received on that port if 
1) the packet is a TCP or UDP packetr.  AND 
2) its source L4 port == destination port

For ports on which the protocol anomaly protection TCP flags 
features has been enabled, this trap will be generated when a TCP 
packet received on that port if 
1) (TCP flag SYN is set) and (its TCP source port < 1024). OR   
2) (TCP flag == 0) and (TCP seq # == 0). OR   
3) (TCP flag FIN/URG/PSH bits sre set) and (TCP seq # == 0). OR   
4) Both TCP iflag SYN and FIN are set

For ports on which the protocol anomaly protection TCP fragment 
features has been enabled, this trap will be generated when a packet 
received on that port if 
1) the packet is a TCP, and its size of the TCP header is less than pre-configured value; or
2) the packet is a TCP and it is a IP fragmented packet (IP offset != 0)

For ports on which the protocol anomaly protection ICMP 
features has been enabled, this trap will be generated when an ICMP 
packet received on that port if 
1) the size of ICMP (IP payload) is large thant pre-configured value; or   
2) it is a fragmented IP/ICMP packet (IP offset != 0)