Tcp Hijack Attack on ips

[szamin125]

Hi Guys,

our cisco ips is under tcp hijack attack the signature id is 3250 ..numbers of servers are targeted by this attack can any body tell me the proper metigation of this attack...

Regards

Sher

[praprama]

here are details of what this signature does:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=3250&signatureSubId=0&softwareVersion=6.0&releaseVersion=S394

Can you post a sample alert for this signature here? feel free to modify any sensitive information (like IP addresses).

Regards,

Prapanch

[szamin125]

Dear Mr. Prapanch,

thanks for your Quick reply please check the logs of cisco IPS below...

signature:   description=TCP Hijack id=3250 version=S394 type=anomaly created=20010202

   subsigId: 0

   sigDetails: TCP Hijack

   marsCategory: Penetrate/HijackSession

interfaceGroup: vs0

vlan: 

participants:  

   attacker:  

     addr: 111.111.111.222 (suppose this is public outside address)locality=OUT

     port: 1063

   target:  

     addr: 10.1.1.1(suppose this is web server) locality=OUT

     port: 80

     os:   idSource=learned type=linux relevance=relevant

actions:  

   denyPacketRequestedNotPerformed: true

riskRatingValue: 100 targetValueRating=medium attackRelevanceRating=relevant

threatRatingValue: 100

Waiting for your reply

Regards

Sher

[praprama]

Hi Sher,

We need to get captures to figure out what's going on here. Is it only between the above 2 IP's that you see this alert?

You  can enable "produce verbose alert" also in addition to the captures and  that way you should be able to figure out which is the offending packet  in the stream.

Thanks and Regards,

Prapanch