Re: syn+fin = stupid?

["J. Oquendo" <intrusion () ENGINEER COM>]

Sounds like a script kiddiot using nmap or something similar in which they think SYN/FIN/NULL/XMAS scanning will avoid 
detection.

A variety of scanners tout these methods as evasive even though most are outdated and measures have been taken to 
acknowledge these types of scans.

------Original Message------
From: marvin () NSS NU
To: INCIDENTS () SECURITYFOCUS COM
Sent: July 29, 2000 9:57:14 AM GMT
Subject: syn+fin = stupid?


I just noticed that a box in korea (210.223.100.97) checked port 21 and
port 53 one day. He/she checked port 21 twice (approx. 2 hours apart) and
port 53 three times (also approx. 2 hours apart). Both were closed all
day, and have never been open on that IP, ever.

I just have one question:

Why syn+fin? Isn't syn+fin something that will NEVER turn up in legit
traffic? It sticks out like nothing else (well, few other things anyway).

______________________________________________
FREE Personalized Email at Mail.com
Sign up at http://www.mail.com/?sr=signup