Security Basics mailing list archives

Strange packet followed by malformed Ethernet frames


From: "Rodrigo Blanco" <rodrigo.blanco.r () gmail com>
Date: Thu, 2 Mar 2006 15:31:49 +0100

Hello list,

I have seen in my network a strange packet (this is not a DMZ, it is
an internal network) with the following flags set: FIN, SYN, RST, ACK,
URG, ECN, CWR. And then, a LOT of malformed frames.

This caused a cut in the network service (about 3000 sessions died).

Could this be an attack? If so, how can I detect / hinder this?

Thanks in advance,
Rodrigo.

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------


Current thread: