> Source: [sk43750](https://support.checkpoint.com/results/sk/sk43750)

# sk43750 - IPS protection "Packet Sanity" drops corrupted TCP packets with "Invalid TCP flag combination" log

| Property | Value |
|----------|-------|
| Solution ID | sk43750 |
| Date Created | 2009-12-30 |
| Last Modified | 2015-08-13 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Corrupted TCP packets (generated by a "bad" host/router) are dropped by IPS protection "Packet Sanity" even though a Network Exception was defined in the IPS protection "Packet Sanity" for the involved Source IP Address.

  SmartView Tracker logs show:

  ```
  
  Type: Log
  Product: IPS
  Protection Type: Protocol Anomaly
  Action: Drop
  Protocol: tcp
  Attack: Malformed Packet
  Attack Information: Invalid TCP flag combination
  ```

* Kernel debug ('`fw ctl debug -m fw + drop packval`') shows:  

  `
  ... ... ...`  
  `
  fwseqvalid_translate_verify: Packet marked as contradictive;`  
  `
  ... ... ...`  
  `
  fw_log_drop: Packet proto= ... dropped by asm_stateless_verifier Reason: Invalid TCP flag combination`

## Cause

Even if the IPS is disabled, the packet can still be dropped by the FireWall because due to packet sanity checks.  
If the packet is not valid, the FireWall marks the packet as "contradictive" and then later on drops it.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content