What is the TCP Split-Handshake Attack and Does It Affect Me?

This report explains the TCP split-handshake attack: a legitimate but unusual TCP handshake variant that a malicious server can use to reverse connection direction and potentially evade gateway security controls (IPS/AV/content filters). It provides technical background, recommends testing with the fakestack.rb tool, and reports that WatchGuard XTM appliances are not vulnerable because they reject split-handshake connections and enable TCP SYN checking by default.