I'm using a couple of CISCO1941/K9 (Version 15.2(2)T1) routers and I've noticed that every time I discover them using Cisco Configuration Professional I get this warning :
IPS-4-SIGNATURE Sig:1102 Subsig:0 Sev:100 Impossible IP Packet [192.168.X.Y:8 -> 192.168.X.Y:0] VRF:NONE RiskRating:100
After a quick research I found that could be a Land attack (not my case) or a false positive (and I believe so).Link :https://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=1102&signatureSubId=0
Moreover it seems that there are some bugs causing this warning (see Cisco Bug: CSCsr49100) but they were found on a different device. Link :https://quickview.cloudapps.cisco.com/quickview/bug/CSCsr49100
I'm quite sure that the warning is caused by a bug but my boss doesn't think so and I have to find a way to convince her.I tried sniffing the traffic on the 192.168.X.Y subnet but there aren't any suspicious packets before the warning.
Is there a way to find out the packet that is causing the warning on the router (after finding it if it's normal I'll have the proof that it's a bug) ?