OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Strange & Consistent RST/ACK packets
From: Security Guru (securityguruHOTMAIL.COM)
Date: Sat Apr 08 2000 - 21:57:17 CDT

At one of my customer sites, I keep seeing uninitated RST/ACK packets with
an acknowledgement number of 674719802. These packets come from many
different source IP addresses and range from a few packets a day to a few
hundered. Is there a known 'attacker' tool that generates these SYN or
SYN/ACKS with a sequence number of 674719801? Or is this just a scanning
tool that looks for ICMP unreachables from my customer's border router?

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com