[Snort-users] "Reset Cause" payload

John Hally JHally at ...5637...
Wed Nov 29 16:20:47 EST 2006


Hello Everyone,

I noticed something in some packet dumps that I haven't seen before.  I'm
not sure what to make of it.  What I'm seeing is an ACK/RST packet with a
"Reset Cause" entry that looks like is filled with some errant HTML.  It
doesn't look nefarious, but it strikes me as odd.  A quick look at
surrounding packets and he browser agent is Mozilla/4.0 (compatible; MSIE
6.0; Windows NT 5.1; SV1) and the server is IIS6.  Has anyone else seen
similar packets and offer an explanation?

Thanks!

John.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20061129/a25d2055/attachment.html>


More information about the Snort-users mailing list