Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IDSM2 TCP Hijack Alarm troubleshooting

Hi,

IDSM2 event viewer shows TCP Hijack alarm for one of the desktops in my network as source and Windows ISA Server firewall as the destination.

The event has fired only once. I am not sure if I should ignore this or how to go about troubleshooting the problem?

Appreciate any help on this.

-- Vasanth

1 REPLY
Silver

Re: IDSM2 TCP Hijack Alarm troubleshooting

The issue is, the filter has been configured for blocking a particular network .So the alarm comes when a data from a particular network reaches the sensor which is blocked by the filter. The work around is to Reset TCP Connection This reset message will Sends TCP resets to hijack and terminate the TCP flow.

215
Views
0
Helpful
1
Replies
CreatePlease to create content