[Snort-users] "Reset Cause" payload
JHally at ...5637...
Wed Nov 29 16:20:47 EST 2006
I noticed something in some packet dumps that I haven't seen before. I'm
not sure what to make of it. What I'm seeing is an ACK/RST packet with a
"Reset Cause" entry that looks like is filled with some errant HTML. It
doesn't look nefarious, but it strikes me as odd. A quick look at
surrounding packets and he browser agent is Mozilla/4.0 (compatible; MSIE
6.0; Windows NT 5.1; SV1) and the server is IIS6. Has anyone else seen
similar packets and offer an explanation?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users