topic Re: TCP Segment Overwrite in Network Security https://community.cisco.com/t5/network-security/tcp-segment-overwrite/m-p/766464#M86355 <HTML><HEAD></HEAD><BODY><P>We turned the sig off since it didn't seem to provide any value.</P></BODY></HTML> Fri, 22 Jun 2007 18:38:57 GMT attmidsteam 2007-06-22T18:38:57Z TCP Segment Overwrite https://community.cisco.com/t5/network-security/tcp-segment-overwrite/m-p/766463#M86353 <P>I'm getting ~ 330,000 "TCP Segment Overwrite" alerts a day from the 6 IDS/IPS sensors. Destination of these packets are 0.0.0.0 or Internal IPs(10.x.x.x). The source IP is mostly Internal Subnet (10.x.x.x). Do I need to investigate these events/alerts?. What do we need to monitor for this event? Do we need to monitor traffic originating from external source? </P> Sun, 10 Mar 2019 10:40:15 GMT https://community.cisco.com/t5/network-security/tcp-segment-overwrite/m-p/766463#M86353 sagittarius 2019-03-10T10:40:15Z Re: TCP Segment Overwrite https://community.cisco.com/t5/network-security/tcp-segment-overwrite/m-p/766464#M86355 <HTML><HEAD></HEAD><BODY><P>We turned the sig off since it didn't seem to provide any value.</P></BODY></HTML> Fri, 22 Jun 2007 18:38:57 GMT https://community.cisco.com/t5/network-security/tcp-segment-overwrite/m-p/766464#M86355 attmidsteam 2007-06-22T18:38:57Z