topic TCP Window Variation Sig fires repeatedly in Network Security https://community.cisco.com/t5/network-security/tcp-window-variation-sig-fires-repeatedly/m-p/1343696#M68656 <P>Sig 1307/0 TCP Window Variation is constantly firing on my IPS. The explanation mentions that some "improperly implemented" firewalls can cause this signature to fire. I have an ASA 5520 between my users and the internet and all internet traffic is NATed. It fires on normal web traffic to known good sites as well as traffic between sites coming in over IPSEC VPN, which is exempted from NAT. Any ideas on what may be causing this?</P> Sun, 10 Mar 2019 11:45:36 GMT jms112080 2019-03-10T11:45:36Z TCP Window Variation Sig fires repeatedly https://community.cisco.com/t5/network-security/tcp-window-variation-sig-fires-repeatedly/m-p/1343696#M68656 <P>Sig 1307/0 TCP Window Variation is constantly firing on my IPS. The explanation mentions that some "improperly implemented" firewalls can cause this signature to fire. I have an ASA 5520 between my users and the internet and all internet traffic is NATed. It fires on normal web traffic to known good sites as well as traffic between sites coming in over IPSEC VPN, which is exempted from NAT. Any ideas on what may be causing this?</P> Sun, 10 Mar 2019 11:45:36 GMT https://community.cisco.com/t5/network-security/tcp-window-variation-sig-fires-repeatedly/m-p/1343696#M68656 jms112080 2019-03-10T11:45:36Z Re: TCP Window Variation Sig fires repeatedly https://community.cisco.com/t5/network-security/tcp-window-variation-sig-fires-repeatedly/m-p/1343697#M68657 <HTML><HEAD></HEAD><BODY><P>This signature Sig 1307/0 will fire when the TCP window varies in a suspect manner. The right edge of the recieve window for TCP decreases. The TCP RFCs state that this should not occur.</P><P></P><P>This signature will NOT function in promiscuous mode.</P><P></P><P>Some incorrectly implemented proxies or network address translation firewalls could modify the window can cause this signature to fire.</P><P></P></BODY></HTML> Tue, 15 Sep 2009 12:50:37 GMT https://community.cisco.com/t5/network-security/tcp-window-variation-sig-fires-repeatedly/m-p/1343697#M68657 smalkeric 2009-09-15T12:50:37Z