TCP: S2C Ambiguity Mismatching Overlapping Data

This protocol anomaly triggers when it detects a TCP segment retransmission from the server to client in which the retransmitted data differs from the original data. Because this is an extremely common IDS evasion attack, it is recommended to drop these packets.

Extended Description

Such a anomalous situation could indicate a TCP configuration or implementation error. It also could indicate that an attack against a TCP implementation is underway.

References

URL: http://www.tcpipguide.com/TCPIPGuide_1-0_s5.pdf http://www.networksorcery.com/enp/protocol/tcp.htm http://condor.depaul.edu/~jkristof/technotes/tcp.html

Short Name

TCP:S2C:AMBIG:OLAP-MISMATCH

Severity

Critical

Recommended

True

Recommended Action

Drop Packet

TCP: S2C Ambiguity Mismatching Overlapping Data

Extended Description

References

Found a potential security threat?