Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

SYN/FIN packets, sig 3041/0

Hi,

I've been noticing that we've been getting an increasing amount of hits on sig 3041-0, TCP SYN/FIN packet. This is always coming from the internal network and is one instance. Has anyone else ever seen this sig being fired and figured out why? I doubt in the cases where I'm seeing it that it is a crafted packet or anything malicious.

Regards,

Jeremy

4 REPLIES
New Member

Re: SYN/FIN packets, sig 3041/0

SYN/FIN packets, sig 3041/0: Triggers when a single TCP packet with the SYN and FIN flags set is sent to a specific host. A reconnaissance sweep of your network may be in progress. The use of this type of packet indicates an attempt to conceal the sweep.

Cisco Employee

Re: SYN/FIN packets, sig 3041/0

It's a strange packet indeed (SYN/FIN), you could use verbose alert on the sig and check the extend of the packets (which source, which destination, how many packets etc...) then assess the state of the stations sending / receiving. Checking the ip ID and TTL is always a good hint on where the packets come from / to. (can be forged but usually give good hints).

New Member

Re: SYN/FIN packets, sig 3041/0

Ya it is kind of an odd packet, haven't figured out yet why one of these would be seen unless crafted. I know which sources and destinations are involved each time but I can never get on the hosts to check em out and see what might have caused it. Good idea about the verbose alert though, I'll try that to see if I get any useful info.

Cisco Employee

Re: SYN/FIN packets, sig 3041/0

Hi,

You can use " ip logging " option available in IDM.Set the source and desti. ip addresses as per the event log and see the complete tcp stream in wireshark to find out more....

Regards,

Sushil

731
Views
0
Helpful
4
Replies