inliniac/suricata — pull request #1162 by decanio (2014-10-10 17:39:01+00:00)
Title: sanity check tcp SACK edges prior to recording. Attempt to avoid Cisco A...

Here's the changes I made to the SACK handling code in an attempt to avoid increasing CPU consumption in the face of the broken Cisco ASA window randomization feature. In spite of the source of the bad SACK data being a result of a broken TCP implementation its seems Suricata could be evaded by a rogue connection maliciously injecting out of window SACK sequence numbers.

...SA

tcp randomization issue with it not properly writing sequence numbers in SACK.