Interpreting Snort's stream5 alerts

Question

I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index.

Snort is showing me a huge amount of, in particular, these two alerts triggered by those clients:

[**] [3:15912:6] BAD-TRAFFIC TCP window closed before receiving data [**]
[Classification: Attempted Denial of Service] [Priority: 2] 
09/26-15:45:58.664104 83.229.XX.YY:48132 -> 94.23.X.YYY:80
TCP TTL:54 TOS:0x0 ID:21980 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x8B4FBB0F  Ack: 0xAB27D5AD  Win: 0x1  TcpLen: 32
TCP Options (3) => NOP NOP TS: 2727533 3015004127 
[Xref => http://technet.microsoft.com/en-us/security/bulletin/MS09-048] \
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1926][Xref => \
http://cve.mitre.org/cg*emphasized text*i-bin/cvename.cgi?name=2008-4609]

------ and ------

[**] [129:4:1] TCP Timestamp is outside of PAWS window [**]
[Classification: Generic Protocol Command Decode] [Priority: 3]
09/26-15:45:57.020788 107.44.X.Y:60795 -> 94.23.X.YYY:80
TCP TTL:47 TOS:0x0 ID:49127 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x2A492B18  Ack: 0x98698C6B  Win: 0x9C72  TcpLen: 32
TCP Options (3) => NOP NOP TS: 15709602 259618837
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1925]

What do these two alerts mean, in the technical sense? Are they harmful?

Answer 1

If MP3's are being run from a network location, then these types of TCP window errors can be common. The MP3 player is trying to 'stream' the data, but is using a protocol that is not designed for efficient streaming.

These are not harmful, although other recommendations might be made about serving MP3 files over a network.