Which technique desynchronizes an IDS from the sequence numbers the kernel honors after a connection is established?

Which technique desynchronizes an IDS from the sequence numbers the kernel honors after a connection is established?

• A. Flooding
• B. Post-Connection SYN
• C. ACK tunneling
• D. HTTP Tunneling

Answer: (B)

Desynchronizing an IDS from the sequence numbers the kernel honors after a connection is established relies on TCP state tracking. Once a TCP connection is up, both sides expect a single, continuous sequence-number progression. By injecting a forged SYN after the legitimate handshake, you force the IDS to create a new connection state for the same endpoints while the kernel continues with the original established connection. The IDS then tracks traffic against the new (or separate) state, but the actual packets belong to the original connection, so the IDS’s view of sequence numbers is out of sync with the kernel. This deliberate mismatch breaks the IDS’s ability to correctly reassemble and interpret the stream. Other techniques either don’t target the post-connection sequence-state desynchronization or focus on covert channels or tunneling rather than purposely misaligning the IDS’s sequence tracking.

Desynchronizing an IDS from the sequence numbers the kernel honors after a connection is established relies on TCP state tracking. Once a TCP connection is up, both sides expect a single, continuous sequence-number progression. By injecting a forged SYN after the legitimate handshake, you force the IDS to create a new connection state for the same endpoints while the kernel continues with the original established connection. The IDS then tracks traffic against the new (or separate) state, but the actual packets belong to the original connection, so the IDS’s view of sequence numbers is out of sync with the kernel. This deliberate mismatch breaks the IDS’s ability to correctly reassemble and interpret the stream.

Other techniques either don’t target the post-connection sequence-state desynchronization or focus on covert channels or tunneling rather than purposely misaligning the IDS’s sequence tracking.