cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
902
Views
0
Helpful
3
Replies

duplicate tcp syn messages

3msands
Level 1
Level 1

'm using the ASA for anyconnect users and I keep seeing log messages similar to the following:

4 date=Oct 07 2009 Source IP=10.1.1.201 Source Port=17571 Destination IP=10.0.250.18 Destination Port53887 Duplicate TCP SYN from inside:10.1.1.201/17571 to inside:10.0.250.18/53887 with different initial sequence number

The source changes from various server (so far our Anti-virus server, dns, and Active directory servers) the destination appears to be client ip's that have disconnected.

I would like to stop this as it is filling my logs up with spurious information

3 Replies 3

auraza
Cisco Employee
Cisco Employee

Do you have another firewall in the middle that may be randomizing sequence numbers?

I do have a firewall services module between them, how do I tell if it is randomizing the sequence numbers?

It does it by default unless you disable it, through a tcp map.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: