TippingPoint
cancel
Showing results for 
Search instead for 
Did you mean: 

Event 7120 issues

AFABER
Occasional Visitor

Event 7120 issues

I am recently taking over an existing Tippingpoint installation that has been extreamly poortly managed.  Trying to reconfigure and organize the deployment.  It is pretty small (about 5 110s and 3 10s with the SMS.)

 

I am seeing an excessive amount of event 7120 "TCP:  Segment overlap With Different Data, e.g. Fragroute".  Almost exclusively on HTTP port 80 traffic.  Going to the IPs listed shows normal, everyday websites (google, amazon etc).  the event is currently set to "Block and Notify"

 

Is this a valid event to Block, is this identifying an issue on our network, could this just be something in our network configuration that changes a packet header?  The event currently is useless, and I would like to turn it off if justified so I can focus on other events.

 

Thanks

4 REPLIES
AFABER
Occasional Visitor

Re: Event 7120 issues

Tracking this down a little more - it seems to be related to Google Chrome.  Only our Chrome users are creating these events, other browsers don't.  Anyone?  Should this event be removed, is it creating user problems?

cthomas35
Advisor

Re: Event 7120 issues

What TOS version are the IPS running?  New versions of the software made improvements that made this filter more accurate and fire less due to the improvements.

GeneDepth
Occasional Visitor

Re: Event 7120 issues

Although 7120 seems to be better than it was in the past, this filter is triggered by valid traffic frequently in almost every deployement we run into.  What are we missing with this filter disabled?  The followup question to that would be why it's still enabled by default?

 

It's really not that big of deal for our clients as we just disable it. But I can see how it could be cnfusing for new customers.

 

Aakil
Occasional Visitor

Re: Event 7120 issues

This activity itself is not an attack, but in conjunction with other activity it is either evidence of malicious intent or malfunctioning network equipment