SYN/FIN packets, sig 3041/0

Unanswered Question
Aug 22nd, 2008

Hi,

I've been noticing that we've been getting an increasing amount of hits on sig 3041-0, TCP SYN/FIN packet. This is always coming from the internal network and is one instance. Has anyone else ever seen this sig being fired and figured out why? I doubt in the cases where I'm seeing it that it is a crafted packet or anything malicious.

Regards,

Jeremy

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 0 (0 ratings)
sadbulali Thu, 08/28/2008 - 14:25

SYN/FIN packets, sig 3041/0: Triggers when a single TCP packet with the SYN and FIN flags set is sent to a specific host. A reconnaissance sweep of your network may be in progress. The use of this type of packet indicates an attempt to conceal the sweep.

jdive Fri, 08/29/2008 - 01:51

It's a strange packet indeed (SYN/FIN), you could use verbose alert on the sig and check the extend of the packets (which source, which destination, how many packets etc...) then assess the state of the stations sending / receiving. Checking the ip ID and TTL is always a good hint on where the packets come from / to. (can be forged but usually give good hints).

jnommensen Fri, 09/05/2008 - 15:27

Ya it is kind of an odd packet, haven't figured out yet why one of these would be seen unless crafted. I know which sources and destinations are involved each time but I can never get on the hosts to check em out and see what might have caused it. Good idea about the verbose alert though, I'll try that to see if I get any useful info.

suschoud Mon, 09/08/2008 - 09:41

Hi,

You can use " ip logging " option available in IDM.Set the source and desti. ip addresses as per the event log and see the complete tcp stream in wireshark to find out more....

Regards,

Sushil

Actions

Login or Register to take actions

This Discussion

Posted August 22, 2008 at 10:20 AM
Stats:
Replies:4 Avg. Rating:
Views:517 Votes:0
Shares:0
Tags: No tags.

Discussions Leaderboard

Rank Username Points
1 816
2 668
3 603
4 526
5 367
Rank Username Points
5
5
5
5
5