TCP: S2C Evasion Urgent Data Out of Window

This protocol anomaly triggers when it detects a TCP packet with urgent data, but the data is not in the receiver window. Because TCP/IP stacks differ in how they handle such packets, this can be an evasion attempt.

Extended Description

If a packet is detected in which the URG flag is set, but the data is not in the receiver window, this constitutes a protocol anomaly. This condition may be the result of a network configuration error. It could also indicate that malicious activity involving transmission of malformed TCP/IP datagrams is underway.

References

URL: http://www.faqs.org/rfcs/rfc793.html

Short Name

TCP:S2C:EVASION:S2C-URG-OUT-WIN

Severity

Minor

Recommended

False

Recommended Action

None

TCP: S2C Evasion Urgent Data Out of Window

Extended Description

References

Found a potential security threat?