[Snort-users] regarding snort's nmap sig.

Ashley Thomas athomas at ...5484...
Wed Dec 11 12:54:04 EST 2002


Hi all,

Does snort have a signature for detecting an NMAP ACK SCAN -
the new version where ACK # is non - zero.

The one signature which i see in the scan.rules matches
older versions of nmap, where the ACK# is set to 0.

Any pointers ?

-Ashley


			-Ashley Thomas (athomas at ...5484...)





More information about the Snort-users mailing list