InfraGuard

Detection rule: Handshake Evasion

Manipulated 3-way handshake seq/ack that disrupts IDS reassembly.

CriticalTCP Stream IntegritySuricata

What it detects

Manipulated 3-way handshake seq/ack that disrupts IDS reassembly.

Why it fires

Likely deliberate evasion aimed at bypassing the IDS/firewall.

Worst case

Undetected intrusion

Matching signatures

evasion

Track these versions on your own servers

InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.

Weekly exploited-vulnerability digest

The KEV additions that matter for self-hosted servers, once a week. No other mail.