Has anyone ever seen TCP RST packets being sent from clients to web server with a "Reset Cause" containing the HTML that was in the packet that they are responding to?
For example a browser client is getting a 404 error returned from my webserver but right after this I am seeing a CP ACK/RST packet from the client with the 404 HTML in the packet. When I look at the packet in Ethereal it shows the HTML in a field called "Reset cause". These packets are causing my IDS to go nuts. ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
