topic Tcp Hijack Attack on ips in Network Security

Tcp Hijack Attack on ips

szamin125 — Sun, 10 Mar 2019 12:28:20 GMT

Hi Guys,

our cisco ips is under tcp hijack attack the signature id is 3250 ..numbers of servers are targeted by this attack can any body tell me the proper metigation of this attack...

Regards

Sher

Tcp Hijack Attack on ips

praprama — Mon, 12 Sep 2011 16:20:34 GMT

here are details of what this signature does:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=3250&signatureSubId=0&softwareVersion=6.0&releaseVersion=S394

Can you post a sample alert for this signature here? feel free to modify any sensitive information (like IP addresses).

Regards,

Prapanch

Tcp Hijack Attack on ips

szamin125 — Tue, 13 Sep 2011 07:41:47 GMT

Dear Mr. Prapanch,

thanks for your Quick reply please check the logs of cisco IPS below...

signature: description=TCP Hijack id=3250 version=S394 type=anomaly created=20010202

subsigId: 0

sigDetails: TCP Hijack

marsCategory: Penetrate/HijackSession

interfaceGroup: vs0

vlan:

participants:

attacker:

addr: 111.111.111.222 (suppose this is public outside address)locality=OUT

port: 1063

target:

addr: 10.1.1.1(suppose this is web server) locality=OUT

port: 80

os: idSource=learned type=linux relevance=relevant

actions:

denyPacketRequestedNotPerformed: true

riskRatingValue: 100 targetValueRating=medium attackRelevanceRating=relevant

threatRatingValue: 100

Waiting for your reply

Regards

Sher

Tcp Hijack Attack on ips

praprama — Tue, 13 Sep 2011 15:21:48 GMT

Hi Sher,

We need to get captures to figure out what's going on here. Is it only between the above 2 IP's that you see this alert?

You can enable "produce verbose alert" also in addition to the captures and that way you should be able to figure out which is the offending packet in the stream.

Thanks and Regards,

Prapanch