Certified Ethical Hacker (CEH) Practice Question

Successful network-level session hijacking relies on injecting spoofed TCP segments whose sequence and acknowledgment numbers fall within the current session window. Modern stateful IDS/IPS platforms maintain per-flow TCP state and validate sequence numbers. Any segment that is out of the expected window, duplicated, or otherwise inconsistent with the tracked state is treated as an evasion or hijacking attempt and discarded. Volume-based DoS detection focuses on traffic rates, DNS anomaly enforcement examines only name-service traffic, and application-layer brute-force signatures key on authentication failures-not on sequence-number integrity-so they would not stop this attack.