SYN/FIN packets, sig 3041/0

Unanswered Question
Aug 22nd, 2008
User Badges:


I've been noticing that we've been getting an increasing amount of hits on sig 3041-0, TCP SYN/FIN packet. This is always coming from the internal network and is one instance. Has anyone else ever seen this sig being fired and figured out why? I doubt in the cases where I'm seeing it that it is a crafted packet or anything malicious.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
sadbulali Thu, 08/28/2008 - 14:25
User Badges:
  • Bronze, 100 points or more

SYN/FIN packets, sig 3041/0: Triggers when a single TCP packet with the SYN and FIN flags set is sent to a specific host. A reconnaissance sweep of your network may be in progress. The use of this type of packet indicates an attempt to conceal the sweep.

jdive Fri, 08/29/2008 - 01:51
User Badges:
  • Cisco Employee,

It's a strange packet indeed (SYN/FIN), you could use verbose alert on the sig and check the extend of the packets (which source, which destination, how many packets etc...) then assess the state of the stations sending / receiving. Checking the ip ID and TTL is always a good hint on where the packets come from / to. (can be forged but usually give good hints).

jnommensen Fri, 09/05/2008 - 15:27
User Badges:

Ya it is kind of an odd packet, haven't figured out yet why one of these would be seen unless crafted. I know which sources and destinations are involved each time but I can never get on the hosts to check em out and see what might have caused it. Good idea about the verbose alert though, I'll try that to see if I get any useful info.

suschoud Mon, 09/08/2008 - 09:41
User Badges:
  • Gold, 750 points or more


You can use " ip logging " option available in IDM.Set the source and desti. ip addresses as per the event log and see the complete tcp stream in wireshark to find out more....




This Discussion