Views:

Here are the different firewall events and their meaning:

EventDetailsRecommended Action
CE FlagsThe CWR or ECE flags were set and the stateful configuration specified that these packets should be denied.This warning appears when you enable the option in Deep Security Enable Stateful Inspection > TCP > Deny TCP packets containing CWR, ECE flags.
If the customer wants to remove the error, disable this option.
Dropped RetransmitThis status means the network engine detected a TCP transmission which content is different from what it sends initially. There are different types of the log in the note field: prev-full, prev-part, next-full and next-part. These are set based on the location of the changed content in the TCP stream.

The network engine checks it by comparing the packet data we queued in engine’s connection buffer to the one re-transmitted. If the changed area is located in the closest queued packet, it will be "prev-full" or "prev-part". We set it as "prev-full" if this queued packet contains all the corresponding data in the re-transmitted packet. Otherwise, it is "prev-part".

Sometimes, the change occurs not in the closest packets but following ones. We set it as “next-full” if the the-transmitted packet contains all of the corresponding data in this queued packet. Otherwise, it is “next-part"

This alert can be avoided by creating firewall bypass rules.
First Fragment Too SmallA fragmented packet was encountered and the size of the fragment is less than the size of a TCP packet (no data)."First fragment too small" is a packet which is dropped when it has the following configuration:
  • MF flag = 1
  • Offset value = 0
  • Total length (maximum combined header length) = less than 120 bytes.
Update the Minimum Fragment size in Network engine to a lower value or "0" to turn off this inspection.
Fragment Offset Too SmallThe offset(s) specified in a fragmented packet sequence is/are less than the size of a valid datagram.Update the Minimum Fragment offset in Network engine to a lower value or "0" to turn off this inspection.
Fragment Out Of BoundsThe offset(s) specified in a fragmented packet sequence is/are outside the range of the maximum size of a datagram.N/A
FragmentedA fragmented packet was encountered with deny fragmented packets disallowed enabled.N/A
Internal Driver ErrorInsufficient resources.Add more system resources to fix this issue.
Internal States ErrorInternal TCP stateful error.Internal TCP stateful error, can be disabled by TCP - unclick Enable TCP stateful inspection.
Invalid ACKA packet with an invalid acknowledgement number was encountered.Verify the Acknowledgment number of the TCP header.
Invalid Adapter ConfigurationAn invalid adapter configuration has been received.Reconfigure the adapter settings.
Invalid Data OffsetInvalid data offset parameterCheck the data offset parameter in network capture case by case.
Invalid FlagsFlag(s) set in packet is/are invalid. This could be due to a flag that does not make sense within the context of a current connection (if any), or due to a nonsensical combination of flags. (Stateful Configuration must be set to “ON” for connection context to be assessed.)This alert can be raised with multiple reasons, check case by case.
Invalid IPThe source IP of the packet is not valid.To allow such packets, customer can change Allow Null IP in Network Engine setting in Deep Security to Yes.
Invalid IP Datagram LengthThe length of the IP datagram is less than the length specified in the IP header.N/A
Invalid Port CommandAn invalid FTP port command was encountered in the FTP control channel data stream.Capture the traffic for detailed analysis.
Invalid SequenceA packet with an invalid sequence number or out-of-window data size was encountered.Capture the traffic for detailed analysis.
Invalid IP Header LengthAn invalid IP header length (< 5*4 = 20) is set in the IP header.N/A
IP Version UnknownAn IP packet other than IPv4 or IPv6 was encountered.Capture the traffic for detailed analysis or ignore this alert.
IPv6 Packet An IPv6 Packet was encountered, and IPv6 blocking is enabled.Change "Block IPv6 on Agents and Appliances versions 9 and later" in Deep Security to No to allow IPv6.
For older version, IPv6 is not supported, but customer still can change to allow.
Max Incoming ConnectionsThe number of incoming connections exceeded the maximum number of connections allowed.In Deep Security Firewall > Firewall Stateful Configurations, click Edit, then in TCP tab, increase the incoming connection number.
Max Outgoing ConnectionsThe number of outgoing connections exceeded the maximum number of connections allowed.In Deep Security Firewall > Firewall Stateful Configurations, click Edit, then in TCP tab, increase the incoming connection number.
Max SYN SentThe number of half open connections from a single computer exceeded that of the specified in the stateful configuration.

This event can be ignored if there is no impact to server's service. Customer can increase the threshold.

In Deep Security Firewall > Firewall Stateful Configurations, click Edit, then in TCP tab, increase the incoming connection number. But do not make it too large, otherwise the server will be vulnerable to DoS attack.

Maximum ACK RetransmitThis retransmitted ACK packet exceeded the ACK storm protection threshold.

It is possible that some host is attacking the server. Check the event source to verify if it is legimate. If it is legimate, customer can enlarge the threshold.

In Deep Security Firewall > Firewall Stateful Configurations, click Edit, then in TCP tab, increase the number for ACK storm protection.

No IP HeaderThe Ethernet header declares the packet as an IP, but the packet is too small to be considered. In some scenarios, the event is triggered is because the IPv4 header is null or the IPv6 header is missing from the whole packet.If the traffic is safe, create a firewall bypass rule for such traffic. If not, let the packet be dropped as it is malicious.
Out Of Allowed PolicyThe packet did not meet any of the Allow or Force Allow rules and so was implicitly denied.If the traffic blocked is supposed to be allowed, use these events to ensure proper firewall rules are created to allow the traffic through.
Out Of ConnectionA packet was received that was not associated with an existing connection.If the session is still established but we have already flushed it out of our state table, the reason in FW events would be Out of Connection when it drops the packet.
Overlapping FragmentThis packet fragment overlaps a previously sent fragment.N/A
Packet on Closed ConnectionA packet belonging to a connection that was already closed was received.It means still receiving packet although the connection was closed. It can be set in ignored status.
Same Source and Destination IPSource and destination IPs were identical.“Same Source and Destination IP” means the packet has the same source and destination IP address. It cannot be fixed by bypass rules.
SYN Cookie ErrorThe SYN cookies protection mechanism encountered an error.N/A
Unknown IP VersionUnrecognized IP versionThis alert cannot be fixed by bypass rules, while the IP version cannot be identified.
Unreadable Ethernet HeaderData contained in this Ethernet frame is smaller than the Ethernet header.N/A
Unreadable IPv4 HeaderThe packet contains an unreadable IPv4 header.Customer should first ensure that the network using readable IPV4 traffic.
Unreadable Protocol HeaderThe packet contains an unreadable TCP, UDP or ICMP header.Capture the traffic for analysis or ignore this error.
Unsolicited ICMPICMP stateful has been enabled (in stateful configuration) and an unsolicited packet that does not match any Force Allow rules was received.To disable this alert, you need to adjust the stateful configuation: ICMP > Click Enable stateful ICMP inspection in Deep Security.
Unsolicited UDPIncoming UDP packets that were not solicited by the computer are rejected.To disable this alert, you need to adjust the stateful configuation: UDP > Click Enable stateful UDP inspection in Deep Security.
Null IPA NULL (0.0.0.0) IP is not allowed by the present firewall configuration.N/A

Apex One Vulnerability Protection customers can configure the engine to ignore status codes in the event of false positives. Perform the following:

  1. Log in to Apex Central / Apex One as a Service.
  2. Go to Policy > Policy Management.
  3. Select the associated policy.
  4. Go to Vulnerability Protection Settings.
  5. Click Network Engine Settings.
  6. Select the detection in Ignore Status Code.

    Module state

  7. Click Deploy.