[Snort-users] Anyone know what this is?

Jason Robertson jason at ...734...
Thu Nov 30 18:42:16 EST 2000


Sadly to say, I have noticed lately their has been a few switches and routers 
on the backbone such mangling packets 

> 
> Nov 29 03:49:09 212.2.215.113:18245 -> my.net.26.7:21536 NOACK 
**U*PRSF
> Nov 29 03:49:16 212.2.215.113:18245 -> my.net.26.7:21536 INVALIDACK 
*2UA*RS*
> RESERVEDBITS

>They definetely look bogus, but probably could be used to fingerprint tcp 
>stack as well.

---
Jason Robertson                
Network Analyst            
jason at ...734...    
http://www.astroadvice.com      



More information about the Snort-users mailing list