"IP.Bad.Header"

[AlexFeren]

I'm receiving the following alertemail:

Message meets Alert condition

The following intrusion was observed: IP.Bad.Header.

date=2016-02-20 time=20:44:52 devname=FG60C devid=FGT60C3G1100XXXX logid=0720018434 type=anomaly subtype=anomaly level=alert vd="root" severity=critical srcip=8.0.69.0 dstip=0.40.196.35 srcintf="wan1" sessionid=0 action=dropped proto=245 service=other count=2 attack="IP.Bad.Header" attackid=127 ref="http://www.fortinet.com/ids/VID127" msg="anomaly: IP.Bad.Header, repeats 2 times" crscore=50 crlevel=critical 

[size="3"]Since  "IP.Bad.Header" does not appear in "get ips rule status" printout,  I am unable to determine which configuration setting is responsible for triggering the attack event. Is it config system global's check-protocol-header (currently set to "loose")?[/size]

R's, Alex

[size="3"]PS. An incomplete "ref" is unhelpful.[/size]