Solved: IDS TCP reset

mjbriggs · ‎02-04-2003

marcabal · ‎02-05-2003

The original Cisco sensors sent the TCP Reset to only the attacking host.

However, later versions of Cisco sensors now send TCP Resets to both the attacker and the victim to allow for a better chance at shutting down the connection.

So the conflict probably originates with which version of the Cisco sensor the writers were most familiar with.

Since SAFE came out after the change had already been made to the sensors, the SAFE exam would most likely be expecting an answer of "sent to both the atacking and attacked hosts".

View solution in original post

mjbriggs · ‎02-05-2003

Could anyone answer a fairly basic question I got in the SAFE exam recently ?

Is the TCP reset sent to the attacking host or is it sent to both the attacking and attacked hosts ? My books on IDS seem to be providing conflicting information .

Cheers

Mike

marcabal · ‎02-05-2003

The original Cisco sensors sent the TCP Reset to only the attacking host.

However, later versions of Cisco sensors now send TCP Resets to both the attacker and the victim to allow for a better chance at shutting down the connection.

So the conflict probably originates with which version of the Cisco sensor the writers were most familiar with.

Since SAFE came out after the change had already been made to the sensors, the SAFE exam would most likely be expecting an answer of "sent to both the atacking and attacked hosts".