[Snort-users] TCP Resets

Josh Berry josh.berry at ...10221...
Fri Feb 27 16:42:02 EST 2004


I am trying to assess the value of using TCP Resets on Exploit attacks
over TCP such as Blaster and Code Red.  It seems as though trying to reset
these types of connections will just double the amount of network traffic
while not stopping the exploit.  Won't the reset reach the machine too
late as the IDS is reacting just after the connection is seen?

Is there only value for doing this if the exploit can be spotted in the
initial SYN but the actual malicious content is contained in the Data
portion after the 3-way-handshake.

Correct me anywhere that I am wrong.

Thanks,
Josh Berry




More information about the Snort-users mailing list