topic Re: Impossible IP packet in Network Security https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628141#M91923 <HTML><HEAD></HEAD><BODY><P>grap a copy of the packet and post it. That should help identify.</P></BODY></HTML> Thu, 09 Nov 2006 18:34:35 GMT mhellman 2006-11-09T18:34:35Z Impossible IP packet https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628140#M91922 <P>We just configured a brand new router. The IDS portion of the router keeps firing on "Impossible ip packet" The source and destination addresses of the alert are the routers external ip address. Any ideas what might be causing this?</P> Sun, 10 Mar 2019 10:18:55 GMT https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628140#M91922 bmcelyea 2019-03-10T10:18:55Z Re: Impossible IP packet https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628141#M91923 <HTML><HEAD></HEAD><BODY><P>grap a copy of the packet and post it. That should help identify.</P></BODY></HTML> Thu, 09 Nov 2006 18:34:35 GMT https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628141#M91923 mhellman 2006-11-09T18:34:35Z Re: Impossible IP packet https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628142#M91924 <HTML><HEAD></HEAD><BODY><P>I've seen this consistently when configuring GRE/IP tunnels. I ended up disabling the ips signature.</P></BODY></HTML> Thu, 09 Nov 2006 19:25:38 GMT https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628142#M91924 mmarlowe 2006-11-09T19:25:38Z Re: Impossible IP packet https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628143#M91925 <HTML><HEAD></HEAD><BODY><P>If the IDS is presented a packet with the same IP address as both source and destination, that will trigger the "impossible IP Packet" alarm. The signature was originally written to flag packets that should not be seen on a network, including things like source IP is a broadcast address.... Normally a same IP source/dest packet would be processed on a host system's internal network loop and never be sent over the wire unless the host was misconfigured (we have seen misconfigured Linux hosts do this). With the embedding of IDS/IPS into network routing gear, it might be (apparently is) possible to have this happen in a legitimate configuration. Our suggestion would be to verify that your router config is correct and working the way you want it and if so, to either disable the signature or exlude the router's address from the alarm channel.</P></BODY></HTML> Tue, 14 Nov 2006 13:58:59 GMT https://community.cisco.com/t5/network-security/impossible-ip-packet/m-p/628143#M91925 scothrel 2006-11-14T13:58:59Z