TCP: Overlapping Urgent Data

This protocol anomaly triggers when it detects overlapping urgent data. While some protocols (like FTP) use the URGPTR flag in the TCP header to signal out-of-band data, it is rare to see overlapping urgent data. This can be an evasion attempt.

Extended Description

TCP datagrams containing overlapping URGENT data, or a set URGENT flag and overlapping sequence numbers constitute a protocol anomaly. The condition could indicate that a data transmission error has occurred, or that an attack involving the injection of malformed datagrams into the network is underway.

References

URL: http://www.faqs.org/rfcs/rfc1180.html

Short Name

TCP:C2S:EXPLOIT:C2S-URG-OVERLAP

Severity

Major

Recommended

False

Recommended Action

Drop Packet

TCP: Overlapping Urgent Data

Extended Description

References

Found a potential security threat?