SYN/FIN packets, sig 3041/0

jnommensen · ‎08-22-2008

Hi,

I've been noticing that we've been getting an increasing amount of hits on sig 3041-0, TCP SYN/FIN packet. This is always coming from the internal network and is one instance. Has anyone else ever seen this sig being fired and figured out why? I doubt in the cases where I'm seeing it that it is a crafted packet or anything malicious.

Regards,

Jeremy

sadbulali · ‎08-28-2008

SYN/FIN packets, sig 3041/0: Triggers when a single TCP packet with the SYN and FIN flags set is sent to a specific host. A reconnaissance sweep of your network may be in progress. The use of this type of packet indicates an attempt to conceal the sweep.

jdive · ‎08-29-2008

It's a strange packet indeed (SYN/FIN), you could use verbose alert on the sig and check the extend of the packets (which source, which destination, how many packets etc...) then assess the state of the stations sending / receiving. Checking the ip ID and TTL is always a good hint on where the packets come from / to. (can be forged but usually give good hints).

jnommensen · ‎09-05-2008

Ya it is kind of an odd packet, haven't figured out yet why one of these would be seen unless crafted. I know which sources and destinations are involved each time but I can never get on the hosts to check em out and see what might have caused it. Good idea about the verbose alert though, I'll try that to see if I get any useful info.

suschoud · ‎09-08-2008

Hi,

You can use " ip logging " option available in IDM.Set the source and desti. ip addresses as per the event log and see the complete tcp stream in wireshark to find out more....

Regards,

Sushil