08-22-2008 10:20 AM - edited 03-10-2019 04:15 AM
Hi,
I've been noticing that we've been getting an increasing amount of hits on sig 3041-0, TCP SYN/FIN packet. This is always coming from the internal network and is one instance. Has anyone else ever seen this sig being fired and figured out why? I doubt in the cases where I'm seeing it that it is a crafted packet or anything malicious.
Regards,
Jeremy
08-28-2008 02:25 PM
SYN/FIN packets, sig 3041/0: Triggers when a single TCP packet with the SYN and FIN flags set is sent to a specific host. A reconnaissance sweep of your network may be in progress. The use of this type of packet indicates an attempt to conceal the sweep.
08-29-2008 01:51 AM
It's a strange packet indeed (SYN/FIN), you could use verbose alert on the sig and check the extend of the packets (which source, which destination, how many packets etc...) then assess the state of the stations sending / receiving. Checking the ip ID and TTL is always a good hint on where the packets come from / to. (can be forged but usually give good hints).
09-05-2008 03:27 PM
Ya it is kind of an odd packet, haven't figured out yet why one of these would be seen unless crafted. I know which sources and destinations are involved each time but I can never get on the hosts to check em out and see what might have caused it. Good idea about the verbose alert though, I'll try that to see if I get any useful info.
09-08-2008 09:41 AM
Hi,
You can use " ip logging " option available in IDM.Set the source and desti. ip addresses as per the event log and see the complete tcp stream in wireshark to find out more....
Regards,
Sushil
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide