<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Can someone please tell me why the connecting to HTTPS websites
are problematic when using the nfqueue run mode? This doesn't
happen when I am using af-packet mode.</p>
<p>In fact in nfqueue mode, I also get the following alerts from
fast.log:</p>
<p>04/10/2018-13:05:49.504292 [**] [1:2210007:2] ITS Safe STREAM
3way handshake SYNACK with wrong ack [**] [Classification: Generic
Protocol Command Decode] [Priority: 3] {TCP} 17.249.105.246:443
-> 192.168.1.180:61378<br>
04/10/2018-13:05:50.534691 [**] [1:2210007:2] ITS Safe STREAM
3way handshake SYNACK with wrong ack [**] [Classification: Generic
Protocol Command Decode] [Priority: 3] {TCP} 17.249.105.246:443
-> 192.168.1.180:61378<br>
04/10/2018-13:05:51.570889 [**] [1:2210007:2] ITS Safe STREAM
3way handshake SYNACK with wrong ack [**] [Classification: Generic
Protocol Command Decode] [Priority: 3] {TCP} 17.249.105.246:443
-> 192.168.1.180:61378<br>
04/10/2018-13:05:53.632130 [**] [1:2210007:2] ITS Safe STREAM
3way handshake SYNACK with wrong ack [**] [Classification: Generic
Protocol Command Decode] [Priority: 3] {TCP} 17.249.105.246:443
-> 192.168.1.180:61378</p>
<p><br>
</p>
<p>This is the error displayed in safari when I am running in-line
IPS mode:</p>
<p><img src="cid:part1.0A2A2152.055A361C@IT-Security-inc.com" alt=""></p>
<p>Any ideas or suggestions?<br>
</p>
<div class="moz-signature">-- <br>
--<br>
<br>
Albert E. Whale, CEH CHS CISA CISSP<br>
Phone: 412-515-3010 | Email: <a class="moz-txt-link-abbreviated" href="mailto:Albert.Whale@IT-Security-inc.com">Albert.Whale@IT-Security-inc.com</a><br>
Cell: 412-889-6870<br>
<br>
</div>
</body>
</html>