What it detects
Application protocol seen in only one direction.
Why it fires
Often scans, aborted sessions or asymmetric capture, but tunneling is possible.
Worst case
Covert channel
Matching signatures
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.