IDSM2 TCP Hijack Alarm troubleshooting

[yvasanthk]

Hi,

IDSM2 event viewer shows TCP Hijack alarm for one of the desktops in my network as source and Windows ISA Server firewall as the destination.

The event has fired only once. I am not sure if I should ignore this or how to go about troubleshooting the problem?

Appreciate any help on this.

-- Vasanth

[thomas.chen]

The issue is, the filter has been configured for blocking a particular network .So the alarm comes when a data from a particular network reaches the sensor which is blocked by the filter. The work around is to Reset TCP Connection This reset message will Sends TCP resets to hijack and terminate the TCP flow.