Duplicate TCP SYN from inside to inside different initial sequence number

[kenneth.greene]

Hello,

Anyone ever seen this?

%ASA-4-419002: Duplicate TCP SYN from inside:10.%.%.%/3283 to inside:10.%.%.%/3283 with different initial sequence number

We are getting incredible amounts of these alerts at first I thought it was some kind of attack. The alerts come from any number of source/destination IP's differetnt ports also.

[ajay chauhan]

Do you mean to say this keep changing source IP addresses ? and those are not in your network .

[kenneth.greene]

The source and the destinations are on my networks, they do keep changing.

[ajay chauhan]

Please post some sequence of logs.

ASA routing table as well.