TCP FIN or RST seq out-of-range
advICE :Intrusions : 2000312

Summary

This may indicate an unsuccessful attempt to hijack a TCP connection. A TCP sequence number is out of the expected range in a FIN or RST packet.

Details

A hacker will send this frame to cause an intrusion detection system (IDS) to become unsynchronized with the data in a connection. Subsequent frames sent in that connection may then be ignored by the IDS.

parametric information dstport The destination port of the TCP frame. srcport The source port of the TCP frame. seq The sequence number seen. expected The expected sequence number.

 
Version appeared: 1.8.6