topic different initial sequence no. in Network Security

different initial sequence no.

suthomas1 — Mon, 11 Mar 2019 18:53:39 GMT

an asa housing a business application server sends out given syslogs quite often.

419002: Duplicate TCP SYN from LOCAL:10.1.1.75/43415 to MILZONE:10.2.90.26/443 with different initial sequence number

this asa is on version 7.0(6) , cisco says it is common in these rel.

is there anything that ought to be inspected in view of this message. or to identify why it is throwing these messages.

TIA.

Re: different initial sequence no.

Namit Agarwal — Wed, 13 Oct 2010 03:42:34 GMT

Hi ,

The explanation for this log message is that a duplicate TCP SYN was received during the three-way-handshake that has a different initial sequence number than the SYN that opened the embryonic connection. This could indicate that SYNs are being spoofed. Someone might be spoofing IP addresses.

Thanks,

Namit

Re: different initial sequence no.

suthomas1 — Wed, 13 Oct 2010 03:45:09 GMT

if that is so, this LOCAL:10.1.1.75 ip belongs to interface of primary firewall before requests reach this server.

how should spoofing be checked if so.

thank you.