What it detects
FIN or segments outside the TCP receive window.
Why it fires
Often teardown races or stack differences, but can be evasion aimed at confusing the state machine.
Worst case
Session-state confusion
Matching signatures
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.