We have three new centers that we cycle our web presence through. For some reason, I am getting anywhere between 30,000 to 50,000 half-open sig events, each from the External and DMZ sensors, when one of those centers are active. However, on the previous infrastructure, it was nowhere near that amount. I am working with the group responsible for maintaining the destinations for these attacks (each center's signature events basically fire on only two desintation IP's that are getting hammered).
My question, however, is there a known issue with the PIX 525's and 535's, or is there any situation at all, that create a false positive half-open syn flood attack? I'm working on finding out any other info that may be pertinent, but I want to pursue all available options as to what might be causing this. Thanks!
