Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

TCP reset packet

Quite often Hackers would send tcp reset packets

is there an Signature for that ??????

cheers

per

2 REPLIES
Cisco Employee

Re: TCP reset packet

Sounds like you are looking for a signature that fires when something like nmap is trying to fingerprint an OS - sig 3046 would fire on a figerprinting attempt. Would need addt'l detail as to exactly what is going on if you want to narrow down a particular type of attack

'

New Member

Re: TCP reset packet

There are several different times when an attacker might send RST packets. What are you looking for?

CSIDS does have signatures that use RST as part of the signature, but we don't alarm on every RST. They do have a valid use as well.

246
Views
0
Helpful
2
Replies