Intrusion PreventionSnort.TCP.SACK.Option.DoS
Description
This signature indicates detection of a TCP protocol anomaly of which a TCP packet containing a SACK option has a unusual short length.
Affected Products
Any host running TCP services
Impact
Protocol Anomaly: This is an anomaly which may also indicate attack attempts in some cases.
Recommended Actions
This indicates detection of traffic that does not comply with the protocol standard.
Monitor the traffic from that network for any suspicious activity.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 17562 |
| Created | Jul 10, 2009 |
| Updated | Nov 03, 2021 |
| Risk |
|
| Default Action | drop |
| Active | |
| Affected OS | Linux, BSD |
| Affected App | Other |