Security Incidents mailing list archives
XMAS scan
From: "E, M" <freehold () EROLS COM>
Date: Tue, 13 Mar 2001 09:25:46 -0800
Yesterday one of the babies announced that it had denied a 'probable' XMAS scan. Considering that the presumptive origin is a .mil/80 (to LAN/42932) and that XMAS theoretically doesn't work on NT because of the all-flags-set (so why bother except for an implied result).....I'm wondering if anyone has had any experience with this 'alert' being triggered by, say, a router with either a sense of humour or a hangover, instead of an nmap-happy curious george. :) TIA for any feedback/explanations -- Missy
Current thread:
- XMAS scan E, M (Mar 13)
- <Possible follow-ups>
- Re: XMAS scan Los, Ralph (Mar 14)