Help with IOS Firewall log message

ovt · ‎09-04-2007

Hi!

If

ip inspect log drop-pkt

is enabled I see a lot of the following error messages:

%FW-6-DROP_TCP_PKT: Dropping tcp pkt 10.1.1.120:2740 => 10.7.1.6:25 due to Stray Segment -- ip ident 48234 tcpflags 0x5004 seq.no 2494264063 ack 2494264063

What does this mean?

vkapoor5 · ‎09-11-2007

"Stray segment" message is logged whenver the FW TCP inspection doesn't expect a TCP message/segment given the session context. Example, reception of a SYN segment from outside to inside when expection is that SYN are initiated from inside.