[Snort-users] Anyone know what this is?

Fyodor fygrave at ...121...
Thu Nov 30 13:31:07 EST 2000


On Wed, Nov 29, 2000 at 09:43:25AM -0500, Bob Fawcett wrote:
> The following is from my portscan log. What does VECNA stand for?

A guy who figured out this type of portscan's hangle :)

> I have also seen this combination of source and dest ports before any meaning there??
> 
> Nov 29 03:49:09 212.2.215.113:18245 -> my.net.26.7:21536 NOACK **U*PRSF
> Nov 29 03:49:16 212.2.215.113:18245 -> my.net.26.7:21536 INVALIDACK *2UA*RS* RESERVEDBITS

They definetely look bogus, but probably could be used to fingerprint tcp stack as well.


-- 
http://www.notlsd.net
PGP fingerprint = 56DD 1511 DDDA 56D7 99C7  B288 5CE5 A713 0969 A4D1



More information about the Snort-users mailing list