I'm using a couple of CISCO1941/K9 (Version 15.2(2)T1) routers and I've noticed that every time I discover them using Cisco Configuration Professional I get this warning :

IPS-4-SIGNATURE Sig:1102 Subsig:0 Sev:100 Impossible IP Packet [192.168.X.Y:8 -> 192.168.X.Y:0] VRF:NONE RiskRating:100

After a quick research I found that could be a Land attack (not my case) or a false positive (and I believe so).Link :https://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=1102&signatureSubId=0

Moreover it seems that there are some bugs causing this warning (see Cisco Bug: CSCsr49100) but they were found on a different device. Link :https://quickview.cloudapps.cisco.com/quickview/bug/CSCsr49100

I'm quite sure that the warning is caused by a bug but my boss doesn't think so and I have to find a way to convince her.I tried sniffing the traffic on the 192.168.X.Y subnet but there aren't any suspicious packets before the warning.

Is there a way to find out the packet that is causing the warning on the router (after finding it if it's normal I'll have the proof that it's a bug) ?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14 '17 at 1:49

Since the log message says it's a Land attack, you could look in your sniffer trace for packets with port=0. If you don't find any, that's a good indication it's a false positive.

Also, look to see if you can identify the source of the packets in the log message. If it is a device you control, you can inspect that device to give it a clean bill of health (or fix it if it isn't).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.