If the IDS is presented a packet with the same IP address as both source and destination, that will trigger the "impossible IP Packet" alarm. The signature was originally written to flag packets that should not be seen on a network, including things like source IP is a broadcast address.... Normally a same IP source/dest packet would be processed on a host system's internal network loop and never be sent over the wire unless the host was misconfigured (we have seen misconfigured Linux hosts do this). With the embedding of IDS/IPS into network routing gear, it might be (apparently is) possible to have this happen in a legitimate configuration. Our suggestion would be to verify that your router config is correct and working the way you want it and if so, to either disable the signature or exlude the router's address from the alarm channel.
