[Snort-users] Null Scan

Ralf Hildebrandt Ralf.Hildebrandt at ...821...
Mon Mar 5 08:05:37 EST 2001


On Mon, Mar 05, 2001 at 07:30:47AM -0500, Peter Charbonneau wrote:

>   Any thoughts as to why the following would show up as a NULL SCAN?
> 
> --
> [**]  <xl1> IDS04 - SCAN-NULL Scan [**]
> 03/05-07:21:26.811166 62.67.64.80:18245 -> 137.x.y.z:21504

Why shouldn't it?
How does the rule (IDS04) look like?

-- 
ralf.hildebrandt at ...821...
System Engineer                                            innominate AG
Diplom-Informatiker                                 the linux architects
tel: +49.30.308806-62  fax: -698                      www.innominate.com




More information about the Snort-users mailing list