[Snort-users] Strange Alerts
neil at ...1633...
Wed Apr 23 08:32:02 EDT 2003
Brett.Gillett at ...8974... wrote asking:
>I have a question regarding alerts that we started to receive once we
>upgraded to Snort 2.0, it seems that all of our sensors started generating
>T/TCP Detected alerts
T/TCP stands for "Transaction TCP", and is a way of dispensing with the
customary three-way handshake used to initiate a TCP exchange over the
network. Do a Google on "t/tcp" and you'll find out lots about it, but
here's a link to get started:
I grepped the source IP in my webserver logs and have so far found that
these packets are commonly associated with "normal" sessions involving
Microsoft IE clients. Are you hosting any websites?
Neil Dickey, Ph.D.
Northern Illinois University
More information about the Snort-users