I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index.

Snort is showing me a huge amount of, in particular, these two alerts triggered by those clients:

[**] [3:15912:6] BAD-TRAFFIC TCP window closed before receiving data [**]
[Classification: Attempted Denial of Service] [Priority: 2] 
09/26-15:45:58.664104 83.229.XX.YY:48132 -> 94.23.X.YYY:80
TCP TTL:54 TOS:0x0 ID:21980 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x8B4FBB0F  Ack: 0xAB27D5AD  Win: 0x1  TcpLen: 32
TCP Options (3) => NOP NOP TS: 2727533 3015004127 
[Xref => http://technet.microsoft.com/en-us/security/bulletin/MS09-048] \
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1926][Xref => \
http://cve.mitre.org/cg*emphasized text*i-bin/cvename.cgi?name=2008-4609]

------ and ------

[**] [129:4:1] TCP Timestamp is outside of PAWS window [**]
[Classification: Generic Protocol Command Decode] [Priority: 3]
09/26-15:45:57.020788 107.44.X.Y:60795 -> 94.23.X.YYY:80
TCP TTL:47 TOS:0x0 ID:49127 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x2A492B18  Ack: 0x98698C6B  Win: 0x9C72  TcpLen: 32
TCP Options (3) => NOP NOP TS: 15709602 259618837
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1925]

What do these two alerts mean, in the technical sense? Are they harmful?


If MP3's are being run from a network location, then these types of TCP window errors can be common. The MP3 player is trying to 'stream' the data, but is using a protocol that is not designed for efficient streaming.

These are not harmful, although other recommendations might be made about serving MP3 files over a network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.