I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index.
Snort is showing me a huge amount of, in particular, these two alerts triggered by those clients:
[**] [3:15912:6] BAD-TRAFFIC TCP window closed before receiving data [**] [Classification: Attempted Denial of Service] [Priority: 2] 09/26-15:45:58.664104 83.229.XX.YY:48132 -> 94.23.X.YYY:80 TCP TTL:54 TOS:0x0 ID:21980 IpLen:20 DgmLen:52 DF ***A**** Seq: 0x8B4FBB0F Ack: 0xAB27D5AD Win: 0x1 TcpLen: 32 TCP Options (3) => NOP NOP TS: 2727533 3015004127 [Xref => http://technet.microsoft.com/en-us/security/bulletin/MS09-048] \ [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1926][Xref => \ http://cve.mitre.org/cg*emphasized text*i-bin/cvename.cgi?name=2008-4609] ------ and ------ [**] [129:4:1] TCP Timestamp is outside of PAWS window [**] [Classification: Generic Protocol Command Decode] [Priority: 3] 09/26-15:45:57.020788 107.44.X.Y:60795 -> 94.23.X.YYY:80 TCP TTL:47 TOS:0x0 ID:49127 IpLen:20 DgmLen:52 DF ***A**** Seq: 0x2A492B18 Ack: 0x98698C6B Win: 0x9C72 TcpLen: 32 TCP Options (3) => NOP NOP TS: 15709602 259618837 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1925]
What do these two alerts mean, in the technical sense? Are they harmful?