That's annoying but not harmful.īut, after some consideration, there are some ruses we can use for evasions.

The IPS would alert, but the end host would drop the packet. For instance, let's say that someone sent a TCP segment with an invalid TCP checksum that contains malicious content 'EVILSTUFF' covered by a rule or signature. I used to think that the only harm that could come from this was a false positive. Now, it might be tempting for an IPS solution to skip this validation process to save some time. If there is a mismatch, the packet is silently dropped. If the value that the receiving host calculates matches the one found in the delivered TCP header checksum, the packet is accepted.

A receiving host performs this same calculation. This is done by taking the one's complement of all 16-bit fields of the TCP header and payload layers and some select fields from the IP header, adding them up, and placing the value in the checksum field of the TCP header.

Is it a problem if an Intrusion Protection System (IPS) does not validate TCP checksums? If you aren't familiar with the concept of TCP checksums, they're used as a means to ensure that data in the TCP header and TCP payload has not gotten corrupted in transit.

Wireshark ip header checksum