Skip to main content
ombudszoe
ombudszoe
New Member
November 22, 2023
Question

Why using Webex triggers Snort.TCP.SACK.Option.DoS IPS alert?

  • November 22, 2023
  • 1 reply
  • 1446 views

Hello!

Does anyone know why participating in a Webex meeting would trigger Snort.TCP.SACK.Option.DoS. alerts?
It's weird that whenever my colleagues in China use Webex meetings, the firewall sends such alerts. But colleagues in other countries had never triggered these alerts.

 

Message as below:

Message meets Alert condition
The following intrusion was observed: Snort.TCP.SACK.Option.DoS.
devid=FGT80ETK19013926 eventtime=1700546688481956986 tz="+0800" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="low" srcip=192.168.120.24 srccountry="Reserved" dstip=173.243.0.86 dstcountry="United States" srcintf="port1" srcintfrole="undefined" dstintf="wan1" dstintfrole="undefined" sessionid=166589540 action="dropped" proto=6 service="SSL" policyid=23 attack="Snort.TCP.SACK.Option.DoS" srcport=32860 dstport=443 hostname="tsa.webex.com" url="/" direction="incoming" attackid=17562 profile="fw_prof_upg_strict" ref="http://www.fortinet.com/ids/VID17562" incidentserialno=94388018 msg="protocol_decoder: Snort.TCP.SACK.Option.DoS" crscore=5 craction=32768 crlevel="low"

 


I know how to whitelist these alerts, but I'm curious why they were triggered.

Thanks in advance!

1 reply

DPadula
Staff & Editor
DPadula
Staff & Editor
November 22, 2023

Hi

According to https://www.fortiguard.com/encyclopedia/ips/17562 it seems that the SACK option is part of a small length TCP packet from the traffic coming from China. 


If you can do an capture of the webex traffic from China and also from another country we could compare both to understand the differences (probably the length). 

Terms & ConditionsAccessibility statement