duplicate tcp syn messages

Unanswered Question
Oct 7th, 2009
User Badges:

I'm using the ASA for anyconnect users and I keep seeing log messages similar to the following:

4 date=Oct 07 2009 Source IP= Source Port=17571 Destination IP= Destination Port53887 Duplicate TCP SYN from inside: to inside: with different initial sequence number

The source changes from various server (so far our Anti-virus server, dns, and Active directory servers) the destination appears to be client ip's that have disconnected.

I would like to stop this as it is filling my logs up with spurious information

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
dhananjoy chowdhury Wed, 10/07/2009 - 20:54
User Badges:
  • Silver, 250 points or more

A duplicate TCP SYN was received during the three-way-handshake that has a different initial sequence number than the SYN that opened the embryonic connection. This could indicate that SYNs are being spoofed. This message occurs in Release and later.



This Discussion