Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Does PIX alter TCP sequence numbers?

Hello all,

I am trying to sniff a session between a server on an "inside" segement and a server on a "DMZ" segment. The server on the inside is being NAT translated to the same address on the DMZ like so:

static (inside,DMZ) netmask 0 0

The problem I am having is comparing the sniffer capture on the inside server to the one on the DMZ server because I think the TCP sequence numbers are being altered. The TCP port numbers appear to be maintained.

Does the PIX alter the TCP sequence numbers? If so does it do so in a predicatble manner?

Also can someone point me to documentation on this behavior?

Thank You


Re: Does PIX alter TCP sequence numbers?


You are right, the PIX does alter TCP sequence numbers. This is done in a random, not predictable manner by ASA. Some good documentation can be found at the following link:

Here's a part of this documentation:

Adaptive Security Algorithm (ASA):

- Implements stateful connection control through the firewall.

- Allows one way (inside to outside) connections without an explicit configuration for each internal system and application.

- Always in operation monitoring return packets to ensure they are valid. Actively randomizes TCP sequence numbers to minimize the risk of TCP sequence number attack.

Hope this helps,


New Member

Re: Does PIX alter TCP sequence numbers?

Thanks for the reply Leo. What I don't understand is if the PIX is always changing the sequence numbers how the end stations are keeping track of them. Is it because the PIX only randomizes the sequence numbers of new sessions and keeps the same sequence throughout the session?

New Member

Re: Does PIX alter TCP sequence numbers?

You're right. The inside client doesn't see any difference in TCP sequence number, the PIX presents another sequence number to the DMZ server or outside. The PIX does a sequence number translation. There is a randomizing at the beginning of new session, and this one is kept for the rest of the session.


New Member

Re: Does PIX alter TCP sequence numbers?

You can turn off the default random sequencing of TCP packet numbers for debugging by using the norandomsequence keyword..

nat [(if_name)] nat_id local_ip [netmask [max_connections [embryonic_limit]]] [norandomsequence]