[Snort-users] Null Scan

Fyodor fygrave at ...121...
Mon Mar 5 08:04:59 EST 2001


On Mon, Mar 05, 2001 at 07:30:47AM -0500, Peter Charbonneau wrote:
> Good Morning,
> 
>   Any thoughts as to why the following would show up as a NULL SCAN?
> 
> --
> [**]  <xl1> IDS04 - SCAN-NULL Scan [**]
> 03/05-07:21:26.811166 62.67.64.80:18245 -> 137.x.y.z:21504


A tcp packet showed up with no flags set. That's what called NULL-SCAN.




More information about the Snort-users mailing list