Signature 1300 TCP Segment Override,

[hquiros]

Hi again, i want to question about this signature because we has seen many alerts related with this signature on our internal network.

When i review the information about this signature in the local signature information page, i dont find nothing that say me about this.

The number of daily alerts from signature 1300 is about 30000, the sources are internal computer against internal server on our switched network.

Can someone help me to find a solution to mitigate this problem.

Thanks

[vkapoor5]

I would suggest you to investigate on why you are seeing this alarm. Are you running any of the custom developed applications on the network? Sometimes this could mean someone trying to bypass your IPS.

If you are convinced that the alarm is false, you can disable the alarm on the IPS.