[Snort-users] Strange Alerts

Neil Dickey neil at ...1633...
Wed Apr 23 08:32:02 EDT 2003


Brett.Gillett at ...8974... wrote asking:

>I have a question regarding alerts that we started to receive once we 
>upgraded to Snort 2.0, it seems that all of our sensors started generating 
>T/TCP Detected alerts

T/TCP stands for "Transaction TCP", and is a way of dispensing with the
customary three-way handshake used to initiate a TCP exchange over the
network.  Do a Google on "t/tcp" and you'll find out lots about it, but
here's a link to get started:

  http://ttcplinux.sourceforge.net/

I grepped the source IP in my webserver logs and have so far found that
these packets are commonly associated with "normal" sessions involving
Microsoft IE clients.  Are you hosting any websites?

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115






More information about the Snort-users mailing list