HPE Community
TippingPoint
1752802 Members
5210 Online
108789 Solutions
New Discussion

Re: Full TCP Handshake Post IP Block

 
Gregohmyeggo
Visitor

‎03-30-2017 08:35 AM - edited ‎03-30-2017 08:40 AM

‎03-30-2017 08:35 AM - edited ‎03-30-2017 08:40 AM

Full TCP Handshake Post IP Block

Hello,

Would there be any legitimate reason to see a successful TCP handshake from an internal host to an external IP address after blocking the external IP address globally at the perimeter?

For instance, we have blocked IP address x.x.x.x globally, but packet capture indicates a full SYN, SYN-ACK, ACK to the external web server before the actual GET/HTTP request is blocked.

0 Kudos
1 REPLY 1
Dennis Handly
Acclaimed Contributor

‎04-02-2017 07:33 PM

‎04-02-2017 07:33 PM

Re: Full TCP Handshake Post IP Block

HPE sold Tippingpoint to Trendmicro in 2015.  Not sure how much help you'll get in this dead forum.

http://newsroom.trendmicro.com/press-release/company-milestones/trend-micro-acquires-hp-tippingpoint

0 Kudos
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.