I have been noticing a number of TCP segment overwrite alerts on our MARS.<BR><BR>All of the events are port 25 connections to our email gateway server which is a Sophos PureMessage AV appliance.