OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Chris Green (cmgsourcefire.com)
Date: Tue Apr 02 2002 - 13:47:11 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    >>Has anyone seen this or know what it may be
    >>related to?
    >>
    >>Mar 31 04:19:35 xxxxfw1 kernel: IN= OUT=eth0
    >>SRC=aa.bb.cc.ddd(me) DST=aa.bb.ee.ff(them)
    >>LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF
    >>PROTO=TCP SPT=80 DPT=2418 WINDOW=0
    >>RES=0x00 ACK RST URGP=0
    >>

    It's very possible that someone is synflooding someone else using your
    IP as the spoofed src. 

    -- 
Chris Green <cmgsourcefire.com>
Fame may be fleeting but obscurity is forever.

    _______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users