Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 3

Duplicate Packet?

Hi all,

I have some questions about Duplicate Packets:

  1. How mcafee IPS treats the duplicate Packets? Does it still scan the duplicate packets or just forward without inspection?
  2. Which packets is considered as duplicate packets? The same (source MAC, Destination MAC), same (source IP, destination IP), same (source port, destination port), same sequence number, etc...
  3. Assume that we have the network like this:
    • Link between SW01 and R1 is configured as trunk
    • McAfee IPS sits between SW01 and R1.
    • We have 3 vlan
    • Traffic from PC1 to PC2 will first hit IPS, received by R1. R1 does routing and forwards this packet to back. This packet will hit the IPS again with the same data from Layer 3 to Layer 7, but the Layer 2 header is changed. So is this packet considered as duplicate packet?
    • What's the best practice for this case? Because if the IPS inspect the same traffic twice, the performance is decreased, duplicate alerts will occur.

Duplicate Packet.png


2 Replies
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: Duplicate Packet?


My assumption is that it will still be processed separately but I did not find additional information except this one:

In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Duplicate Packet?

To prevent the failover pair from forwarding the same alert twice, each node in the pair adheres to the following rules:

  • The Sensor that received the attack packet on its monitoring port sends the signature alert to the Manager. (The Sensor that gets a copy of the attack packet from its failover peer does not send an alert.)
  • The Sensor forwarding the alert also takes the configured response action, such as sending a TCP reset.
  • The Sensor that has been online the longest is responsible for sending all reconnaissance and DoS alerts to the Manager.
  • In the event that both Sensors have been up for exactly the same amount time, the Sensor with the higher value serial number will be responsible for sending all reconnaissance and DoS alerts.



Was my reply helpful?
If you find this post useful, please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community