IDS fragment overlap error

**EnglishPaul** · 10-15-2007, 02:29 PM

I'm a bit of a computer novice really, so it may be quite an obvious explanation, but recently I changed the error reporting method of Mc Afee and subsequently have had lots of intrusion events flagged up.
All of them are noted by Mc Afee personal firewall plus as IDS: Fragment Overlap Error. And using the tracking tool, all come from Tehran. Mc Afee fails to find more details than that about the server or event nature.

Hopefully someone can explain what is going on, whether there is anything more I can do about it, and also whether this is likely to be the cause of IE locking up very frequently in recent times.

**EnglishPaul** · 10-21-2007, 08:38 AM

McAfee mentions that this may be a denial of service attack.
Is there any way to stop one of these? And is it my computer that is being attacked or my ISP? Also how does this attack find 'me' when I do not have a fixed IP address?

Any ideas?

**EnglishPaul** · 10-21-2007, 09:23 AM

O.K. also thought to add the details from McAfee tracking. Doesn't mean much to me. It seems to mention M$ alot, so I don't know if it is something I've subscribed to. But, again I doubt M$ would choose Tehran as the best place to send me data from!

I also assume that none of this data is private.

This is the RIPE Whois query server 3.
The objects are in RPSL format.

Rights restricted by copyright.
See http://www.ripe.net/db/copyright.html

Note: This output has been filtered.
To receive output for a database update, use the -B flag.

Information related to '213.199.160.0 - 213.199.191.255'

inetnum: 213.199.160.0 - 213.199.191.255
netname: MSFT-IDC
descr:
org: ORG-MA42-RIPE
descr: Microsoft Internet Data Center
country: GB
country: IE
admin-c: AS9763-RIPE
tech-c: BR329-ARIN
status: ASSIGNED PA
mnt-by: MICROSOFT-MAINT
mnt-domains: MICROSOFT-MAINT
source: RIPE Filtered

organisation: ORG-MA42-RIPE
org-name: Microsoft
org-type: LIR
address: One Microsoft Way
address: WA 98052
address: Redmond
address: United States
phone: +1 (425) 705 0516
fax-no: +1 425 936 7329
e-mail: allies@microsoft.com
admin-c: BR329-ARIN
admin-c: EN603-RIPE
admin-c: AS9763-RIPE
mnt-ref: MICROSOFT-MAINT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE Filtered

person: Allie Settlemyre
address: Microsoft Limited
address: One Microsoft Way,
address: Redmond, WA 98052
address: USA
phone: +1 (425) 705 0516
phone: +1 (425) 936 7329
nic-hdl: AS9763-RIPE
source: RIPE Filtered

person: Bharat Ranjan
address: Microsoft Corporation
address: Redmond, WA, 98102
address: One Microsoft Way
address: USA
phone: +1 (425) 706 3230
fax-no: +1 (425) 936 7329
nic-hdl: BR329-ARIN
source: RIPE Filtered
e-mail: bharatr@microsoft.com

Information related to '213.199.160.0/20AS8068'

route: 213.199.160.0/20
descr: Microsoft European IDCs
origin: AS8068
mnt-by: MICROSOFT-MAINT
source: RIPE Filtered

**Glaswegian** · 10-21-2007, 09:56 AM

Hi

Not something I've seen before and I can't find any info. Have you tried McaFee's own help forum?

http://forums.mcafeehelp.com/

10-15-2007, 02:29 PM	#1 (permalink)
EnglishPaul Still no avatar Join Date: Sep 2007 Location: Sheffield Posts: 1,314 OS: XP SP2 Blog Entries: 9	IDS fragment overlap error I'm a bit of a computer novice really, so it may be quite an obvious explanation, but recently I changed the error reporting method of Mc Afee and subsequently have had lots of intrusion events flagged up. All of them are noted by Mc Afee personal firewall plus as IDS: Fragment Overlap Error. And using the tracking tool, all come from Tehran. Mc Afee fails to find more details than that about the server or event nature. Hopefully someone can explain what is going on, whether there is anything more I can do about it, and also whether this is likely to be the cause of IE locking up very frequently in recent times.

10-21-2007, 08:38 AM	#2 (permalink)
EnglishPaul Still no avatar Join Date: Sep 2007 Location: Sheffield Posts: 1,314 OS: XP SP2 Blog Entries: 9	Re: IDS fragment overlap error McAfee mentions that this may be a denial of service attack. Is there any way to stop one of these? And is it my computer that is being attacked or my ISP? Also how does this attack find 'me' when I do not have a fixed IP address? Any ideas?

10-21-2007, 09:23 AM	#3 (permalink)
EnglishPaul Still no avatar Join Date: Sep 2007 Location: Sheffield Posts: 1,314 OS: XP SP2 Blog Entries: 9	Re: IDS fragment overlap error O.K. also thought to add the details from McAfee tracking. Doesn't mean much to me. It seems to mention M$ alot, so I don't know if it is something I've subscribed to. But, again I doubt M$ would choose Tehran as the best place to send me data from! I also assume that none of this data is private. This is the RIPE Whois query server 3. The objects are in RPSL format. Rights restricted by copyright. See http://www.ripe.net/db/copyright.html Note: This output has been filtered. To receive output for a database update, use the -B flag. Information related to '213.199.160.0 - 213.199.191.255' inetnum: 213.199.160.0 - 213.199.191.255 netname: MSFT-IDC descr: org: ORG-MA42-RIPE descr: Microsoft Internet Data Center country: GB country: IE admin-c: AS9763-RIPE tech-c: BR329-ARIN status: ASSIGNED PA mnt-by: MICROSOFT-MAINT mnt-domains: MICROSOFT-MAINT source: RIPE Filtered organisation: ORG-MA42-RIPE org-name: Microsoft org-type: LIR address: One Microsoft Way address: WA 98052 address: Redmond address: United States phone: +1 (425) 705 0516 fax-no: +1 425 936 7329 e-mail: allies@microsoft.com admin-c: BR329-ARIN admin-c: EN603-RIPE admin-c: AS9763-RIPE mnt-ref: MICROSOFT-MAINT mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT source: RIPE Filtered person: Allie Settlemyre address: Microsoft Limited address: One Microsoft Way, address: Redmond, WA 98052 address: USA phone: +1 (425) 705 0516 phone: +1 (425) 936 7329 nic-hdl: AS9763-RIPE source: RIPE Filtered person: Bharat Ranjan address: Microsoft Corporation address: Redmond, WA, 98102 address: One Microsoft Way address: USA phone: +1 (425) 706 3230 fax-no: +1 (425) 936 7329 nic-hdl: BR329-ARIN source: RIPE Filtered e-mail: bharatr@microsoft.com Information related to '213.199.160.0/20AS8068' route: 213.199.160.0/20 descr: Microsoft European IDCs origin: AS8068 mnt-by: MICROSOFT-MAINT source: RIPE Filtered

10-21-2007, 09:56 AM	#4 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,482 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	Re: IDS fragment overlap error Hi Not something I've seen before and I can't find any info. Have you tried McaFee's own help forum? http://forums.mcafeehelp.com/ __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner