topic Re: IPS - tcp segment overwrite - WAY TOO MANY in Network Security

IPS - tcp segment overwrite - WAY TOO MANY

tverhoeven — Sun, 10 Mar 2019 10:39:42 GMT

We had consultants install our new ips. They recommended plugging into a switch connecting our firewall to our internet router. We have a bunch of VPN tunnels terminating at our ASA firewall from our remote offices. When I check the logs on the IPS, there are tons of alerts for "tcp segment overwrite" and alot of them come from the vpn sites. My question is, what can I do to alleviate some of these messages? I can't believe that we are being attacked this much.

To clarify our installation, we have 2 switches, one in each of our two buildings, and they are connected via fibre. We have a ASA in each building and they are setup for redundancy. Our IPS has only one interface plugged into the same vlan the hosts the firewall and the internet router.

thanks

Re: IPS - tcp segment overwrite - WAY TOO MANY

jlimbo — Tue, 19 Jun 2007 00:29:46 GMT

If this is in an inline scenario the offending packets are dropped by default. To investigate it further I check to see what other alerts are triggering for the offending hosts. This will give you more information to ascertain what these hosts are really doing.

Re: IPS - tcp segment overwrite - WAY TOO MANY

tverhoeven — Tue, 19 Jun 2007 00:43:33 GMT

this is not inline...only have one interface.

I checked through and handful of the logs and I have ip's from my internal network and from remote vpn connections. Is there a way to search thru the log to find multiple occurrences of the same host???

Re: IPS - tcp segment overwrite - WAY TOO MANY

mhellman — Tue, 19 Jun 2007 12:43:58 GMT

we have the same issue. we see them too much in "normal" traffic for the sig to be useful.

Re: IPS - tcp segment overwrite - WAY TOO MANY

mlhall — Tue, 19 Jun 2007 18:21:24 GMT

If you are on a 4250, 4250XL or a IDSM-2 then you might be hitting CSCsg23774.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsg23774

The defect was corrected in 6.0(1).

Re: IPS - tcp segment overwrite - WAY TOO MANY

tverhoeven — Wed, 20 Jun 2007 14:26:38 GMT

Thanks man...that seemed to do the trick.

Good thing I did not do that upgrade last week when I was studying for the IPS exam. Whole new interface would have thrown me off.