[Snort-users] tcp/510 probe

Al Huger - Mail Account ah1 at ...35...
Tue Nov 28 10:00:37 EST 2000


> 	- Window size: 0x3fff (16383) 
> 	  (I don't know of any OS using that Window Size. As far as I
> 	   know, the closest are AIX, which sets it to 16000-16100 but
> 	   with a TTL of 60 and Windows 2k setting it to 17000-18000 but
> 	   with a TTL of 128)
> 
> 	Just one (probably crafted) SYN packet coming from Hawaii Online.
> Has anyone experienced the same? Does anyone know about any broken client
> that might produce a packet like that? 
> 
> 	Cheers,
> 
> 								JESS
> 
> _______________________________________________


This has also been reported to the Incidents mailing list:

http://www.securityfocus.com/archive/75/147118




More information about the Snort-users mailing list