Security

 View Only
Back to discussions
Expand all | Collapse all

Full TCP Handshake Post IP Block

This thread has been viewed 1 times

  • 1.  Full TCP Handshake Post IP Block

    Posted Mar 30, 2017 11:35 AM

    Hello,

    Would there be any legitimate reason to see a successful TCP handshake from an internal host to an external IP address after blocking the external IP address globally at the perimeter?

    For instance, we have blocked IP address x.x.x.x globally, but packet capture indicates a full SYN, SYN-ACK, ACK to the external web server before the actual GET/HTTP request is blocked.



  • 2.  RE: Full TCP Handshake Post IP Block

    Posted Apr 02, 2017 10:33 PM

    HPE sold Tippingpoint to Trendmicro in 2015.  Not sure how much help you'll get in this dead forum.

    http://newsroom.trendmicro.com/press-release/company-milestones/trend-micro-acquires-hp-tippingpoint



Related Content