This is may be a false positive. The intrusion is triggered if the TCP data has changed within two frames. In theory, this should never happen. However, some recent TCP implementations (Win 2000 and some Unix implementations) send "status" information after a RESET within the data part of the frame. This condition, which results in a false detection, has been addresed in the 3.0 release of BlackICE.
ik rust mijn kaas