anyone know the name(s) and/or a url to find the tool?

may be one tool or family of tools derived from the same base code (note the
hand-crafted ID always = 39426 and the Advertised Window = 0x404)

I'm trying to correlate what I'm seeing on snort with what my personal
firwall is logging and I want to be able to generate the traffic myself
(tired of having to wait hours or days between random tests to be farted out
of the global sewer).

TIA

/r

Sample TCPDUMP output:
13:48:34.322789 eth0 P 216.94.60.156.ftp > mypc.any.org.ftp: SF
1808792213:1808792213(0) win 1028 (ttl 32, id 39426)

Snort Alerts:
[**] IDS198 - SCAN-SYN FIN [**]
01/17-13:48:34.322789 216.94.60.156:21 -> mypc.any.org:21
TCP TTL:32 TOS:0x0 ID:39426
******SF Seq: 0x6BCFFA95 Ack: 0x2A10533A Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/05-12:12:39.719091 63.192.141.74:9704 -> mypc.any.org:9704
TCP TTL:28 TOS:0x0 ID:39426
******SF Seq: 0x2703CFEA Ack: 0x61CCA06C Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/06-03:56:13.515113 210.97.240.11:53 -> mypc.any.org:53
TCP TTL:30 TOS:0x0 ID:39426
******SF Seq: 0x6FF04448 Ack: 0x4D87885F Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/06-09:54:25.972394 202.190.201.1:21 -> mypc.any.org:21
TCP TTL:28 TOS:0x0 ID:39426
******SF Seq: 0x54C519C7 Ack: 0x4D77D9B4 Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/07-01:02:20.752179 62.149.151.160:110 -> mypc.any.org:110
TCP TTL:27 TOS:0x0 ID:39426
******SF Seq: 0x34FF17B7 Ack: 0x786DB88A Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/07-15:01:54.877206 158.42.57.42:111 -> mypc.any.org:111
TCP TTL:31 TOS:0x0 ID:39426
******SF Seq: 0x2837B8A6 Ack: 0x2AEF650D Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/13-17:53:45.478701 62.98.137.208:21 -> mypc.any.org:21
TCP TTL:25 TOS:0x0 ID:39426
******SF Seq: 0x68AEE551 Ack: 0x8A124BE Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/17-20:35:18.211718 64.248.77.18:21 -> mypc.any.org:21
TCP TTL:28 TOS:0x0 ID:39426
******SF Seq: 0x7B63CDF2 Ack: 0x2917D0D3 Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/18-02:37:35.013479 216.162.96.39:21 -> mypc.any.org:21
TCP TTL:33 TOS:0x0 ID:39426
******SF Seq: 0x791F0C00 Ack: 0x740815C2 Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/18-02:42:25.382507 64.148.165.60:21 -> mypc.any.org:21
TCP TTL:29 TOS:0x0 ID:39426
******SF Seq: 0x791F0C00 Ack: 0x740815C2 Win: 0x404

[**] IDS198 - SCAN-SYN FIN [**]
01/18-12:18:37.819176 150.131.108.239:21 -> mypc.any.org:21
TCP TTL:30 TOS:0x0 ID:39426
******SF Seq: 0x484A23DD Ack: 0x2277E3D Win: 0x404

THE END

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]