[Snort-users] not your typical : BAD-TRAFFIC tcp port 0 traffic portscanning?

Michael Scheidell scheidell at ...5171...
Fri May 25 08:15:47 EDT 2007

anyone else getting this? same 'destination' ip  several
'destination' ports, 8000, 80,53.

I have seen this at several clients sites, (same 'destination') but
different 'source' (client is always source)

Any idea what they are doing? Trying to portscan? Looking for some
vulnerability with 'dest port' 0?

05/25-09:22:49 TCP -->  xxx.xxx.xxx.xxx :0
[1:524:8] BAD-TRAFFIC tcp port 0 traffic
[Classification: Misc activity] [Priority: 3] 

#(2 - 738314) [2007-05-25 07:43:37] [snort/524] BAD-TRAFFIC tcp port 0
IPv4: -> xxx.xxx.xxx.xxx
hlen=5 TOS=0 dlen=40 ID=51608 flags=0 offset=0 TTL=238 chksum=35950
TCP: port=80 -> dport: 0 flags=***A*R** seq=0
ack=759384068 off=5 res=0 win=0 urp=0 chksum=50032
Payload: none
This email has been scanned and certified safe by SpammerTrap(tm).
For Information please see http://www.spammertrap.com

More information about the Snort-users mailing list