[Snort-devel] ECN bits evade SYN detection

Chris Green cmg at ...402...
Tue Aug 13 05:37:02 EDT 2002


Chris Green <cmg at ...402...> writes:

> Dirk Mueller <dmuell at ...224...> writes:
>
>
> S,ECN
>
flags: S,12  means

Check for S against the tcp_header with the 12 bits masked away.

Thanks,
Chris
-- 
Chris Green <cmg at ...402...>
Laugh and the world laughs with you, snore and you sleep alone.




More information about the Snort-devel mailing list