What it detects
Segments whose TCP timestamp option conflicts with the session context.
Why it fires
Usually asymmetric routing, NAT or retransmits — but can signal session insertion or hijacking.
Worst case
TCP injection · IDS evasion
Matching signatures
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.